pip-audit

pip-audit pip-audit is a tool for scanning Python environments for packages with known vulnerabilities. It uses the Python Packaging Advisory Database https://github.com/pypa/advisory-database via the PyPI JSON API as a source of vulnerability reports. This project is maintained in part by Trail ...

advisory-database

Python Packaging Advisory Database This is a community owned repository of advisories for packages published on https://pypi.org. Advisories live in the vulns directory and use a YAML encoding of a simple format. Contributing advisories Making a pull request Existing entries can be edited by simp...

rustsec

RustSec Crates 🦀🛡️📦 The RustSec Advisory Database is a repository of security advisories filed against Rust crates published via crates.io. The advisory database itself can be found at: https://github.com/RustSec/advisory-db About this repository This repository contains a Cargo Workspace with all...

-Ruby-dl-handle.c-CVE-2009-5147-

Ruby Advisory Database The Ruby Advisory Database is a community effort to compile all security advisories that are relevant to Ruby libraries. You can check your own Gemfile.locks against this database by using bundler-audit. Support Ruby security! Do you know about a vulnerability that isn't...

GHSA-3P64-6GVH-82V5

creationtimestamp| type| source ---|---|--- 2026-08-17 23:31:40+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a 2026-08-18 00:01:16+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a...

GHSA-48P8-G2FX-3WWM

creationtimestamp| type| source ---|---|--- 2026-08-13 17:32:46+00:00| seen| https://gist.github.com/alon710/ee760ed8dd4e3944f68b62f514473cdc...

GHSA-PFVM-W89X-94JW

creationtimestamp| type| source ---|---|--- 2026-08-12 20:31:49+00:00| seen| https://gist.github.com/alon710/05e3ea6ef79e0a47d082b88eec33ae87...

How we took malware advisories beyond npm

A compromised package can steal credentials the moment you install it, and until recently, GitHub could only flag those in npm. Not anymore. This is the story of how the supply chain engineering team behind Dependabot expanded malware advisories to eight ecosystems by building on OpenSSF's shared...

libsodium has Incomplete List of Disallowed Inputs

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to cryptocoreed25519isvalidpoint, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.This advisoory...

Inside the Advisory Database and what happens when vulnerability volume breaks records

In May 2026, the GitHub Advisory Database published 1,560 reviewed advisories --more than five times our typical monthly output and the highest in its history. And it still wasn't enough to keep up. Over the past few months, the vulnerability ecosystem has shifted in a fundamental way. Input acro...

cve-arsenal

CVE Arsenal Automated CVE exploit scanners and Nuclei templat...

Securing the open source supply chain across GitHub

Over the past year, a new pattern has emerged in attacks on the open source supply chain. Attackers are focusing on exfiltrating secrets like API keys in order to both publish malicious packages from an attacker-controlled machine as well as gain access to more projects in order to propagate the...

A year of open source vulnerability trends: CVEs, advisories, and malware

GitHub published 4,101 reviewed advisories in 2025. This is the fewest number of reviewed advisories since 2021. Does this mean open source is shipping more secure code? Let's dig into the data to find out. GitHub reviewed advisories Fewer advisories reviewed doesn't mean fewer vulnerabilities we...

OCaml Security Advisory Database Security Vulnerabilities

The OCaml Security Advisory Database is a security database developed under the open-source OCaml language. Versions prior to 4.14.3 and 5.x versions before 5.4.1 of the OCaml Security Advisory Database contain security vulnerabilities. These vulnerabilities stem from excessive buffer reading...

GHSA-MRFV-M5WM-5W6W libsodium has Incomplete List of Disallowed Inputs

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to cryptocoreed25519isvalidpoint, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group. This advisoory...

OPENSUSE-SU-2025:15652-1 cargo-audit-advisory-db-20251021-1.1 on GA media

These are all security issues fixed in the cargo-audit-advisory-db-20251021-1.1 package on the GA media of openSUSE Tumbleweed...

ruby-advisory-db

This is a database of security advisories for Ruby libraries, maintained by the ruby-advisory-db project. The database contains a list of directories that match the names of Ruby libraries on rubygems.org, with each directory containing one or more advisory files for the library. Each advisory fi...

MAL-2025-46924 Malicious code in advisory_db_toolkit (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6f9757e1ad29ad430d32886a0fcfa47e48a29e5e4af901f48e305216133028e6 The OpenSSF Package Analysis project identified 'advisorydbtoolkit' @ 99.99.99 rubygems as malicious. It is considered malicious because: - The...

GitHub Advisory Database by the numbers: Known security vulnerabilities and what you can do about them

The GitHub Advisory Database Advisory DB is a vital resource for developers, providing a comprehensive list of known security vulnerabilities and malware affecting open source packages. This post analyzes trends in the Advisory DB, highlighting the growth in reviewed advisories, ecosystem coverag...

OPENSUSE-SU-2024:11953-1 cargo-audit-advisory-db-20220323-1.1 on GA media

These are all security issues fixed in the cargo-audit-advisory-db-20220323-1.1 package on the GA media of openSUSE Tumbleweed...