Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,624
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,528
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

114 advisories

Loading
AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching Critical
CVE-2026-49757 was published for ash_authentication (Erlang) Aug 25, 2026
jimsynz Credited to jimsynz, maennchen, and jarlah maennchen maennchen
jarlah jarlah
gRPC Erlang package has unbounded gzip decompression (decompression bomb) High
CVE-2026-53430 was published for grpc (Erlang) Aug 25, 2026
PJUllrich Credited to PJUllrich and polvalente polvalente polvalente
gRPC Erlang package has unbounded request body accumulation in `read_full_body/3` High
CVE-2026-48854 was published for grpc (Erlang) Aug 25, 2026
PJUllrich Credited to PJUllrich, polvalente, and maennchen polvalente polvalente
maennchen maennchen
gRPC Erlang package's path bindings are overridable by query string and request body High
CVE-2026-48599 was published for grpc (Erlang) Aug 25, 2026
PJUllrich Credited to PJUllrich, polvalente, and maennchen polvalente polvalente
maennchen maennchen
gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads Critical
CVE-2026-48853 was published for grpc (Erlang) Aug 25, 2026
PJUllrich Credited to PJUllrich, polvalente, and maennchen polvalente polvalente
maennchen maennchen
membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion Moderate
CVE-2026-53423 was published for membrane_mp4_plugin (Erlang) Aug 18, 2026
varsill Credited to varsill, mat-hek, and maennchen mat-hek mat-hek
maennchen maennchen
Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS Moderate
CVE-2026-32686 was published for decimal (Erlang) May 12, 2026
PJUllrich Credited to PJUllrich, ericmj, josevalim, wojtekmach, maennchen, ruslandoga, warmwaffles, and tiagoefmoraes ericmj ericmj
josevalim josevalim wojtekmach wojtekmach maennchen maennchen ruslandoga ruslandoga warmwaffles warmwaffles tiagoefmoraes tiagoefmoraes
cowboy and gun affected by an HTTP Request/Response Splitting vulnerability Moderate
CVE-2026-43966 was published for cowboy (Erlang) Jun 8, 2026
gun has an Unexpected Status Code or Return Value vulnerability High
CVE-2026-43974 was published for gun (Erlang) Jun 8, 2026
gun_http2 has an Origin Validation Error vulnerability Moderate
CVE-2026-43972 was published for gun (Erlang) Jun 8, 2026
gun has an Uncontrolled Resource Consumption vulnerability High
CVE-2026-43973 was published for gun (Erlang) Jun 8, 2026
Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type Moderate
CVE-2026-49756 was published for req (Erlang) Jul 29, 2026
PJUllrich Credited to PJUllrich and maennchen maennchen maennchen
Req vulnerable to unbounded archive/compression extraction triggered by response content-type High
CVE-2026-49755 was published for req (Erlang) Jul 29, 2026
PJUllrich Credited to PJUllrich and maennchen maennchen maennchen
Protobuf: Unbounded recursion depth in embedded-message decoding High
CVE-2026-54451 was published for protobuf (Erlang) Jul 15, 2026
PJUllrich Credited to PJUllrich and whatyouhide whatyouhide whatyouhide
Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values Low
CVE-2026-48598 was published for tesla (Erlang) Jul 10, 2026
PJUllrich Credited to PJUllrich, yordis, and maennchen yordis yordis
maennchen maennchen
Tesla vulnerable to atom exhaustion via untrusted URL scheme High
CVE-2026-48597 was published for tesla (Erlang) Jul 10, 2026
PJUllrich Credited to PJUllrich, yordis, and maennchen yordis yordis
maennchen maennchen
Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering High
CVE-2026-48595 was published for tesla (Erlang) Jul 10, 2026
PJUllrich Credited to PJUllrich, yordis, and maennchen yordis yordis
maennchen maennchen
Tesla has decompression bomb on response body High
CVE-2026-48594 was published for tesla (Erlang) Jul 10, 2026
PJUllrich Credited to PJUllrich, yordis, and maennchen yordis yordis
maennchen maennchen
Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param` Low
CVE-2026-48596 was published for tesla (Erlang) Jul 10, 2026
PJUllrich Credited to PJUllrich, yordis, and maennchen yordis yordis
maennchen maennchen
mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS High
CVE-2026-48862 was published for mint (Erlang) Jul 9, 2026
PJUllrich Credited to PJUllrich, ericmj, and maennchen ericmj ericmj
maennchen maennchen
mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood) High
CVE-2026-49754 was published for mint (Erlang) Jul 9, 2026
PJUllrich Credited to PJUllrich, ericmj, and maennchen ericmj ericmj
maennchen maennchen
mint: Content-Length header accepts non-RFC "+" sign prefix Moderate
CVE-2026-49753 was published for mint (Erlang) Jul 9, 2026
PJUllrich Credited to PJUllrich, ericmj, and maennchen ericmj ericmj
maennchen maennchen
mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target` Low
CVE-2026-48861 was published for mint (Erlang) Jul 9, 2026
PJUllrich Credited to PJUllrich, maennchen, and ericmj maennchen maennchen
ericmj ericmj
QUIC has Broken TLS verification Critical
CVE-2026-49457 was published for quic (Erlang) Jul 1, 2026
benmmurphy Credited to benmmurphy
oban_web missing authorization check on `save-job` event handler Moderate
CVE-2026-48592 was published for oban_web (Erlang) Jun 30, 2026
PJUllrich Credited to PJUllrich, sorentwo, and maennchen sorentwo sorentwo
maennchen maennchen
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database