Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,624
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,528
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

1,528 advisories

Loading
Zebra: Finalized address balance credit-first overflow on consensus-valid blocks Moderate
CVE-2026-52738 was published for zebra-state (Rust) Jul 2, 2026
sangsoo-osec Credited to sangsoo-osec, mpguerra, and oxarbitrage mpguerra mpguerra
oxarbitrage oxarbitrage
Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block Moderate
CVE-2026-52737 was published for zebra-consensus (Rust) Jul 2, 2026
ipwning Credited to ipwning, mpguerra, conradoplg, and oxarbitrage mpguerra mpguerra
conradoplg conradoplg oxarbitrage oxarbitrage
zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser Critical
CVE-2026-52735 was published for zebra-script (Rust) Jul 2, 2026
samsulselfut Credited to samsulselfut and mpguerra mpguerra mpguerra
Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache High
CVE-2026-52736 was published for zebra-state (Rust) Jul 2, 2026
ipwning Credited to ipwning, x15-eth, upbqdn, conradoplg, and mpguerra x15-eth x15-eth
upbqdn upbqdn conradoplg conradoplg mpguerra mpguerra
Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length Low
GHSA-h72h-ppcx-998p was published for zebra-network (Rust) Jul 2, 2026
ouicate Credited to ouicate and oxarbitrage oxarbitrage oxarbitrage
zebrad has mempool transaction admission denial via single-peer inbound queue saturation Moderate
CVE-2026-52732 was published for zebrad (Rust) Jul 2, 2026
dingledropper Credited to dingledropper, mpguerra, and oxarbitrage mpguerra mpguerra
oxarbitrage oxarbitrage
zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers Moderate
GHSA-c8w6-x74f-vmg3 was published for zebra-rpc (Rust) Jul 2, 2026
robustfengbin Credited to robustfengbin, mpguerra, and upbqdn mpguerra mpguerra
upbqdn upbqdn
zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length Low
GHSA-443g-gwgp-49x4 was published for zebra-chain (Rust) Jul 2, 2026
dingledropper Credited to dingledropper, mpguerra, and oxarbitrage mpguerra mpguerra
oxarbitrage oxarbitrage
zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate Moderate
CVE-2026-52731 was published for zebra-rpc (Rust) Jul 2, 2026
sangsoo-osec Credited to sangsoo-osec, mpguerra, and upbqdn mpguerra mpguerra
upbqdn upbqdn
Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set Moderate
CVE-2026-50185 was published for cmov (Rust) Jul 2, 2026
robinhundt Credited to robinhundt
SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted Moderate
CVE-2026-49997 was published for surrealdb (Rust) Jul 1, 2026
SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation Moderate
GHSA-fwg2-gr34-q3w8 was published for surrealdb (Rust) Jul 1, 2026
q1uf3ng Credited to q1uf3ng
SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths Moderate
GHSA-c8jx-96c9-8xrp was published for surrealdb (Rust) Jul 1, 2026
SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization Moderate
GHSA-wp87-mgvq-5j93 was published for surrealdb (Rust) Jul 1, 2026
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect Moderate
GHSA-97vg-427p-8hx5 was published for surrealdb (Rust) Jul 1, 2026
SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions Moderate
GHSA-6wqw-vhfr-9999 was published for surrealdb (Rust) Jul 1, 2026
SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission Moderate
GHSA-f82j-v89j-mf86 was published for surrealdb (Rust) Jul 1, 2026
SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from` Moderate
GHSA-fpxg-5xmv-922m was published for surrealdb (Rust) Jul 1, 2026
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages Moderate
GHSA-6g9v-7gq3-p2c6 was published for surrealdb (Rust) Jul 1, 2026
SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls Moderate
GHSA-4m82-p8cx-f94j was published for surrealdb (Rust) Jul 1, 2026
LucyEgan Credited to LucyEgan and addcontent addcontent addcontent
SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames Moderate
GHSA-65rj-r9fh-jp2v was published for surrealdb (Rust) Jul 1, 2026
SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries Moderate
GHSA-gcwr-5mrf-fvch was published for surrealdb (Rust) Jul 1, 2026
SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required Moderate
GHSA-4v76-cw68-4vc9 was published for surrealdb (Rust) Jul 1, 2026
LucyEgan Credited to LucyEgan
SurrealDB has an Authorization Bypass via Composite Record-id Paths Moderate
GHSA-6vg3-hgrw-p5gf was published for surrealdb (Rust) Jul 1, 2026
SurrealDB: Graph traversal bypasses table SELECT permissions Moderate
GHSA-vjjx-rfw4-rmfc was published for surrealdb (Rust) Jul 1, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database