Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,608
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,528
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19
Unreviewed advisories have not been assessed by GitHub for quality and do not connect to the Dependabot service.

203 advisories

Loading
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding... Low Unreviewed
CVE-2026-48932 was published Sep 1, 2026
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in... High Unreviewed
CVE-2026-74848 was published Aug 27, 2026
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1... Moderate Unreviewed
CVE-2026-73051 was published Aug 14, 2026
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by... Moderate Unreviewed
CVE-2026-14180 was published Aug 11, 2026
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated... Moderate Unreviewed
CVE-2026-72587 was published Aug 10, 2026
An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server... Critical Unreviewed
CVE-2026-9190 was published Aug 5, 2026
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding... Low Unreviewed
CVE-2026-58044 was published Aug 4, 2026
HTTP Smuggling in cPanel allows potential leak of credentials. Moderate Unreviewed
CVE-2026-58047 was published Jul 31, 2026
Apache Traffic Server truncates over-long header names, allowing header aliasing, request... Critical Unreviewed
CVE-2026-58155 was published Jul 29, 2026
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked... Moderate Unreviewed
CVE-2026-58153 was published Jul 29, 2026
Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue... High Unreviewed
CVE-2026-57834 was published Jul 29, 2026
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade... High Unreviewed
CVE-2026-58150 was published Jul 29, 2026
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in... Moderate Unreviewed
CVE-2026-24033 was published Jul 29, 2026
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0... High Unreviewed
CVE-2026-15325 was published Jul 28, 2026
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0... High Unreviewed
CVE-2026-15328 was published Jul 28, 2026
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0... High Unreviewed
CVE-2026-15064 was published Jul 28, 2026
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote... Moderate Unreviewed
CVE-2026-67182 was published Jul 28, 2026
tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote... Moderate Unreviewed
CVE-2026-66752 was published Jul 28, 2026
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote... Moderate Unreviewed
CVE-2026-67181 was published Jul 28, 2026
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing... Moderate Unreviewed
CVE-2026-66338 was published Jul 25, 2026
Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed... Moderate Unreviewed
CVE-2026-12606 was published Jul 14, 2026
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker... Critical Unreviewed
CVE-2026-27690 was published Jul 14, 2026
OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header... Moderate Unreviewed
CVE-2025-3110 was published Jul 8, 2026
ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state,... High Unreviewed
CVE-2026-38969 was published Jul 2, 2026
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0... High Unreviewed
CVE-2026-11541 was published Jul 1, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database