Vulnerability reports are arriving faster than GitHub can review them

Across the open source world, people are reporting software flaws in record numbers, and the systems built to verify those reports are straining under the weight. The GitHub Advisory Database, which feeds automated security alerts to millions of projects, has reached a point where some new advisories take weeks to publish. In May 2026, the database published 1,560 reviewed advisories, the most in its history and several times its usual monthly output.