Updated 2026-11-12 11:22 UTC
10,059 advisories in limbo
Published by maintainers on GitHub, in ecosystems GitHub reviews, but not yet in GitHub’s reviewed database or OSV.
- Critical
- 964
- High
- 3,954
- Medium
- 4,207
- Low
- 934
| Package | Advisory | Severity | CVE | Waiting | Fixed in |
|---|---|---|---|---|---|
| Loading… | |||||
Ranges and fixed versions are as entered by maintainers and haven’t been reviewed.
What the CVE states mean
No CVE anywhere
No CVE ID on the advisory, and no record in the CVE List refers to it. Neither GitHub-based nor CVE-based tools know it exists.
CVE reserved (RBP)
The advisory cites a CVE ID whose record isn’t published. Looking the ID up returns nothing.
CVE published, cited
CVE-based tools can find it. GitHub- and OSV-based scanners still can’t, until GitHub reviews it.
CVE from another CNA
Another CNA, usually VulnCheck, published a CVE pointing to the advisory, which doesn’t cite it.