GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
6 advisories
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
Moderate
CVE-2026-54285
was published
for
@opentelemetry/core
(npm)
Jun 15, 2026
aiohttp: CRLF injection in multipart headers
Low
CVE-2026-50269
was published
for
aiohttp
(pip)
Jun 15, 2026
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
Moderate
CVE-2026-48736
was published
for
symfony/http-client
(Composer)
Jun 15, 2026
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Moderate
CVE-2026-53655
was published
for
tar
(npm)
Jun 15, 2026
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
High
CVE-2026-49982
was published
for
tmp
(npm)
Jun 15, 2026
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)
Moderate
CVE-2026-47753
was published
for
github.com/lxc/incus/v7
(Go)
Jun 10, 2026
ProTip!
Advisories are also available from the
GraphQL API