GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
25 advisories
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
Moderate
CVE-2026-116577
was published
for
tornado
(pip)
Oct 28, 2026
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
Moderate
CVE-2026-110816
was published
for
qs
(npm)
Oct 27, 2026
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
Moderate
CVE-2026-108360
was published
for
phpoffice/phpspreadsheet
(Composer)
Oct 27, 2026
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
High
GHSA-f9j4-qggq-h239
was published
for
GitPython
(pip)
Oct 27, 2026
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
Moderate
GHSA-4ffr-jq9g-5ffx
was published
for
nodemailer
(npm)
Oct 27, 2026
Electron: Pointer lock permission requests can be attributed to the wrong frame
Moderate
CVE-2026-113798
was published
for
electron
(npm)
Oct 22, 2026
Electron: Frame subscription trusts GPU-supplied frame geometry
Low
CVE-2026-114122
was published
for
electron
(npm)
Oct 22, 2026
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
Low
CVE-2026-114124
was published
for
electron
(npm)
Oct 22, 2026
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
High
CVE-2026-114143
was published
for
toml
(npm)
Oct 22, 2026
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
Critical
GHSA-cg2g-xh64-v4q7
was published
for
dompurify
(npm)
Oct 22, 2026
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
Moderate
CVE-2026-110871
was published
for
nodemailer
(npm)
Oct 22, 2026
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
Moderate
CVE-2026-114129
was published
for
stream-json
(npm)
Oct 22, 2026
pypdf: Possible infinite loop when removing tree items
Moderate
CVE-2026-113793
was published
for
pypdf
(pip)
Oct 21, 2026
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
Moderate
CVE-2026-113671
was published
for
@apostrophecms/ai-helper
(npm)
Oct 20, 2026
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
Moderate
CVE-2026-113655
was published
for
apostrophe
(npm)
Oct 20, 2026
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
High
CVE-2026-113666
was published
for
@apostrophecms/db-connect
(npm)
Oct 20, 2026
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
Moderate
GHSA-p3pr-8f3m-4qp8
was published
for
pyload-ng
(pip)
Oct 9, 2026
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
High
CVE-2026-107227
was published
for
org.asynchttpclient:async-http-client
(Maven)
Oct 8, 2026
Ghost : Stored XSS via SVG Files in Content Imports
Moderate
CVE-2026-105644
was published
for
ghost
(npm)
Oct 7, 2026
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
High
CVE-2026-106440
was published
for
hydra-optuna-sweeper
(pip)
Oct 7, 2026
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
Moderate
GHSA-3hv7-mjh2-fv65
was published
for
tornado
(pip)
Sep 30, 2026
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
Low
GHSA-p98j-92pf-mc4p
was published
for
dompurify
(npm)
Sep 30, 2026
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
High
GHSA-3q6v-r5mr-hxv8
was published
for
league/commonmark
(Composer)
Sep 30, 2026
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
Low
CVE-2026-101915
was published
for
@grpc/grpc-js
(npm)
Sep 30, 2026
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
Moderate
CVE-2026-86818
was published
for
fast-uri
(npm)
Sep 29, 2026
ProTip!
Advisories are also available from the
GraphQL API