Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,741
Maven
5,000+
npm
5,000+
NuGet
1,116
pip
5,000+
Pub
13
RubyGems
1,152
Rust
1,570
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

479 advisories

Loading
The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory -... Critical Unreviewed
CVE-2026-82617 was published Sep 11, 2026
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path High
CVE-2026-86081 was published for n8n (npm) Sep 10, 2026
Masofgon Credited to Masofgon
An authenticated client could attach a consumer with a selector containing crafted wildcard usage... Unknown Unreviewed
CVE-2026-75880 was published Sep 10, 2026
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor... High Unreviewed
CVE-2026-87819 was published Sep 9, 2026
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing High
GHSA-j95f-988m-3j2f was published for @tiptap/core (npm) Sep 8, 2026
joostgrunwald Credited to joostgrunwald
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser High
CVE-2026-83619 was published for @xmldom/xmldom (npm) Sep 8, 2026
karfau Credited to karfau
Colord: Slow rejection of oversized malformed color strings Moderate
CVE-2026-85062 was published for colord (npm) Sep 8, 2026
GAP-dev Credited to GAP-dev
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions High
CVE-2026-83606 was published for @xmldom/xmldom (npm) Sep 8, 2026
NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks Moderate
CVE-2026-81725 was published for nltk (pip) Sep 8, 2026
NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions High
CVE-2026-80206 was published for nltk (pip) Sep 8, 2026
infycore Credited to infycore, ekaf, and agent-kira ekaf ekaf
agent-kira agent-kira
NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions High
CVE-2026-80205 was published for nltk (pip) Sep 8, 2026
infycore Credited to infycore, ekaf, and agent-kira ekaf ekaf
agent-kira agent-kira
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m Moderate
CVE-2026-73556 was published for vllm (pip) Sep 4, 2026
CyberKareem Credited to CyberKareem and jperezdealgaba jperezdealgaba jperezdealgaba
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a... High Unreviewed
CVE-2026-84642 was published Sep 2, 2026
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters High
GHSA-j8pm-gj4c-rq4x was published for league/commonmark (Composer) Sep 1, 2026
colinodell Credited to colinodell
Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions High
GHSA-vf76-f5cp-9846 was published for nltk (pip) Aug 31, 2026 • withdrawn
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email... Moderate Unreviewed
CVE-2024-58379 was published Aug 31, 2026
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching High
CVE-2026-55520 was published for Protego (pip) Aug 28, 2026
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS High
CVE-2026-57584 was published for phalcon/cphalcon (Composer) Aug 28, 2026
nikkoenggaliano Credited to nikkoenggaliano
Duplicate Advisory: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions High
GHSA-2rrw-hpqm-36pv was published for nltk (pip) Aug 26, 2026 • withdrawn
Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking High
GHSA-5jhf-fpp7-v2pv was published for nokogiri (RubyGems) Aug 25, 2026 • withdrawn
SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression... High Unreviewed
CVE-2026-66766 was published Aug 25, 2026
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking High
CVE-2026-72818 was published for nltk (pip) Aug 21, 2026
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression... Moderate Unreviewed
CVE-2026-77082 was published Aug 20, 2026
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) High
CVE-2026-59893 was published for sqlparse (pip) Aug 17, 2026
EQSTLab Credited to EQSTLab, min8282, and 7thParkk min8282 min8282
7thParkk 7thParkk
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger High
CVE-2026-54284 was published for sqlparse (pip) Aug 17, 2026
tonghuaroot Credited to tonghuaroot
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database