pip-audit

pip-audit pip-audit は、既知の脆弱性を持つパッケージをスキャンするためのPython環境向けツールです。脆弱性レポートのソースとして、PyPI JSON APIを介してPython Packaging Advisory Database https://github.com/pypa/advisory-databaseを利用します。 このプロジェクトは、Trail of Bits と Google の支援により部分的にメンテナンスされています。これはGoogleまたはTrail of Bitsの公式製品ではありません。 Index...

pip-audit

pip-audit pip-audit is a tool for scanning Python environments for packages with known vulnerabilities. It uses the Python Packaging Advisory Database https://github.com/pypa/advisory-database via the PyPI JSON API as a source of vulnerability reports. This project is maintained in part by Trail ...

rustsec

RustSec クレート 🦀🛡️📦 RustSec アドバイザリデータベースは、crates.io で公開されている Rust クレートに対して報告されたセキュリティアドバイザリをまとめたリポジトリです。 アドバイザリデータベース自体は、以下で参照できます: https://github.com/RustSec/advisory-db このリポジトリについて このリポジトリには、RustSec プロジェクトが保守しているすべてのクレートを含む Cargo ワークスペースが格納されています:...

-Ruby-dl-handle.c-CVE-2009-5147-

Ruby アドバイザリデータベース Ruby Advisory Database は、Ruby ライブラリに関連するすべてのセキュリティアドバイザリをまとめるコミュニティの取り組みです。 このデータベースに対して自身の Gemfile.lock をチェックするには、bundler-audit を使用できます。 Ruby セキュリティをサポート！ このデータベースに記載されていない脆弱性をご存知ですか？ Issue を開くか、PR を送信するか、このフォーム を使用してメンテナーにメールを送信してください。 ディレクトリ構造 データベースは、rubygems.org 上の Ruby...

GHSA-3P64-6GVH-82V5

creationtimestamp| type| source ---|---|--- 2026-08-17 23:31:40+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a 2026-08-18 00:01:16+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a...

GHSA-48P8-G2FX-3WWM

creationtimestamp| type| source ---|---|--- 2026-08-13 17:32:46+00:00| seen| https://gist.github.com/alon710/ee760ed8dd4e3944f68b62f514473cdc...

GHSA-PFVM-W89X-94JW

creationtimestamp| type| source ---|---|--- 2026-08-12 20:31:49+00:00| seen| https://gist.github.com/alon710/05e3ea6ef79e0a47d082b88eec33ae87...

Inside the Advisory Database and what happens when vulnerability volume breaks records

In May 2026, the GitHub Advisory Database published 1,560 reviewed advisories --more than five times our typical monthly output and the highest in its history. And it still wasn't enough to keep up. Over the past few months, the vulnerability ecosystem has shifted in a fundamental way. Input acro...

cve-arsenal

CVE Arsenal Automated CVE exploit scanners and Nuclei templat...

Securing the open source supply chain across GitHub

Over the past year, a new pattern has emerged in attacks on the open source supply chain. Attackers are focusing on exfiltrating secrets like API keys in order to both publish malicious packages from an attacker-controlled machine as well as gain access to more projects in order to propagate the...

A year of open source vulnerability trends: CVEs, advisories, and malware

GitHub published 4,101 reviewed advisories in 2025. This is the fewest number of reviewed advisories since 2021. Does this mean open source is shipping more secure code? Let's dig into the data to find out. GitHub reviewed advisories Fewer advisories reviewed doesn't mean fewer vulnerabilities we...

OCaml Security Advisory Database 安全漏洞

The OCaml Security Advisory Database is a security database developed under the open-source OCaml language. Versions prior to 4.14.3 and 5.x versions before 5.4.1 of the OCaml Security Advisory Database contain security vulnerabilities. These vulnerabilities stem from excessive buffer reading...

GHSA-MRFV-M5WM-5W6W libsodium has Incomplete List of Disallowed Inputs

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to cryptocoreed25519isvalidpoint, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group. This advisoory...

OPENSUSE-SU-2025:15652-1 cargo-audit-advisory-db-20251021-1.1 on GA media

These are all security issues fixed in the cargo-audit-advisory-db-20251021-1.1 package on the GA media of openSUSE Tumbleweed...

ruby-advisory-db

This is a database of security advisories for Ruby libraries, maintained by the ruby-advisory-db project. The database contains a list of directories that match the names of Ruby libraries on rubygems.org, with each directory containing one or more advisory files for the library. Each advisory fi...

MAL-2025-46924 Malicious code in advisory_db_toolkit (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6f9757e1ad29ad430d32886a0fcfa47e48a29e5e4af901f48e305216133028e6 The OpenSSF Package Analysis project identified 'advisorydbtoolkit' @ 99.99.99 rubygems as malicious. It is considered malicious because: - The...

GitHub Advisory Database by the numbers: Known security vulnerabilities and what you can do about them

The GitHub Advisory Database Advisory DB is a vital resource for developers, providing a comprehensive list of known security vulnerabilities and malware affecting open source packages. This post analyzes trends in the Advisory DB, highlighting the growth in reviewed advisories, ecosystem coverag...

OPENSUSE-SU-2024:11953-1 cargo-audit-advisory-db-20220323-1.1 on GA media

These are all security issues fixed in the cargo-audit-advisory-db-20220323-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11708-1 cargo-audit-advisory-db-20220105-1.1 on GA media

These are all security issues fixed in the cargo-audit-advisory-db-20220105-1.1 package on the GA media of openSUSE Tumbleweed...

rusty_paseto vulnerable to private key extraction due to ed25519-dalek dependency

Impact The vulnerability, known as RUSTSEC-2022-0093, impacts the ed25519-dalek crate, which is a dependency of the rusty-paseto crate. This issue arises from a "Double Public Key Signing Function Oracle Attack" affecting versions of ed25519-dalek prior to v2.0. These versions expose an unsafe AP...