{"note": {"noteId": 357, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0xf4085bb7e31c3abc6bb9478a300719b26cad3e8d801595275ba684fb26266661", "content": "{\"counts\":{\"changed\":16,\"published\":2,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-02\",\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-03T01:01:39Z\",\"rows\":[{\"advisory\":\"https://github.com/advisories/GHSA-f9j6-8p6x-r9j6\",\"aliases\":[\"CVE-2026-62374\"],\"commit\":\"https://github.com/github/advisory-database/commit/714474ad30864fbfc71ec0cefc1a454bb23763f9\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/714474ad30864fbfc71ec0cefc1a454bb23763f9/advisories/github-reviewed/2026/11/GHSA-f9j6-8p6x-r9j6/GHSA-f9j6-8p6x-r9j6.json\",\"id\":\"GHSA-f9j6-8p6x-r9j6\",\"packages\":[\"@sd-jwt/decode\",\"@sd-jwt/core\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-f9j6-8p6x-r9j6/GHSA-f9j6-8p6x-r9j6.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"SD JWT JS: Tampered disclosures silently dropped instead of rejected\"},{\"advisory\":\"https://github.com/advisories/GHSA-j656-3hf2-fvjc\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c/advisories/github-reviewed/2026/11/GHSA-j656-3hf2-fvjc/GHSA-j656-3hf2-fvjc.json\",\"id\":\"GHSA-j656-3hf2-fvjc\",\"packages\":[\"@bytebase/dbhub\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-j656-3hf2-fvjc/GHSA-j656-3hf2-fvjc.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation\"},{\"advisory\":\"https://github.com/advisories/GHSA-593v-wcqx-hq2w\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/fc5d42155fec5ec1d99600e0116af511fb281c9d\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/fc5d42155fec5ec1d99600e0116af511fb281c9d/advisories/github-reviewed/2021/09/GHSA-593v-wcqx-hq2w/GHSA-593v-wcqx-hq2w.json\",\"id\":\"GHSA-593v-wcqx-hq2w\",\"packages\":[\"parse-server\"],\"path\":\"advisories/github-reviewed/2021/09/GHSA-593v-wcqx-hq2w/GHSA-593v-wcqx-hq2w.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Incorrect version tags linked to external repository\"},{\"advisory\":\"https://github.com/advisories/GHSA-62gx-5q78-wrvx\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/1d4cd95343cec306ca25af2ff701101a186a82a7\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/1d4cd95343cec306ca25af2ff701101a186a82a7/advisories/github-reviewed/2026/07/GHSA-62gx-5q78-wrvx/GHSA-62gx-5q78-wrvx.json\",\"id\":\"GHSA-62gx-5q78-wrvx\",\"packages\":[\"obsidian-local-rest-api\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-62gx-5q78-wrvx/GHSA-62gx-5q78-wrvx.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} \u2014 arbitrary host file read/write/delete\"},{\"advisory\":\"https://github.com/advisories/GHSA-wcjj-9m6g-2fr2\",\"aliases\":[\"CVE-2026-59176\"],\"commit\":\"https://github.com/github/advisory-database/commit/c99b68a106442b6fa5d954af56dd58c59c4e8617\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/c99b68a106442b6fa5d954af56dd58c59c4e8617/advisories/github-reviewed/2026/09/GHSA-wcjj-9m6g-2fr2/GHSA-wcjj-9m6g-2fr2.json\",\"id\":\"GHSA-wcjj-9m6g-2fr2\",\"packages\":[\"functype-mcp-server\"],\"path\":\"advisories/github-reviewed/2026/09/GHSA-wcjj-9m6g-2fr2/GHSA-wcjj-9m6g-2fr2.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import\"},{\"advisory\":\"https://github.com/advisories/GHSA-2x63-gw47-w4mm\",\"aliases\":[\"CVE-2026-61666\"],\"commit\":\"https://github.com/github/advisory-database/commit/b5542e1d1ef8751817ac573f83d4433c852ede80\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/b5542e1d1ef8751817ac573f83d4433c852ede80/advisories/github-reviewed/2026/07/GHSA-2x63-gw47-w4mm/GHSA-2x63-gw47-w4mm.json\",\"id\":\"GHSA-2x63-gw47-w4mm\",\"packages\":[\"websocket-driver\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-2x63-gw47-w4mm/GHSA-2x63-gw47-w4mm.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"websocket-driver-ruby: Denial of service via malformed Host header\"},{\"advisory\":\"https://github.com/advisories/GHSA-crwc-vw2r-qr6m\",\"aliases\":[\"CVE-2026-113730\"],\"commit\":\"https://github.com/github/advisory-database/commit/1e24e5f4b872224ded9288b412cea0b5957cdb5e\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/1e24e5f4b872224ded9288b412cea0b5957cdb5e/advisories/github-reviewed/2026/10/GHSA-crwc-vw2r-qr6m/GHSA-crwc-vw2r-qr6m.json\",\"id\":\"GHSA-crwc-vw2r-qr6m\",\"packages\":[\"ognl:ognl\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-crwc-vw2r-qr6m/GHSA-crwc-vw2r-qr6m.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies\"},{\"advisory\":\"https://github.com/advisories/GHSA-8mgp-746c-j5xp\",\"aliases\":[\"CVE-2026-81726\"],\"commit\":\"https://github.com/github/advisory-database/commit/fc9a22d2ae88d6a10dda69215596c9400648ba9e\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/fc9a22d2ae88d6a10dda69215596c9400648ba9e/advisories/github-reviewed/2026/09/GHSA-8mgp-746c-j5xp/GHSA-8mgp-746c-j5xp.json\",\"id\":\"GHSA-8mgp-746c-j5xp\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/09/GHSA-8mgp-746c-j5xp/GHSA-8mgp-746c-j5xp.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots\"},{\"advisory\":\"https://github.com/advisories/GHSA-2vqw-3mp8-cgmx\",\"aliases\":[\"CVE-2026-47737\"],\"commit\":\"https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-2vqw-3mp8-cgmx/GHSA-2vqw-3mp8-cgmx.json\",\"id\":\"GHSA-2vqw-3mp8-cgmx\",\"packages\":[\"puma\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-2vqw-3mp8-cgmx/GHSA-2vqw-3mp8-cgmx.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections\"},{\"advisory\":\"https://github.com/advisories/GHSA-qpgp-93vx-g8v8\",\"aliases\":[\"CVE-2026-47736\"],\"commit\":\"https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-qpgp-93vx-g8v8/GHSA-qpgp-93vx-g8v8.json\",\"id\":\"GHSA-qpgp-93vx-g8v8\",\"packages\":[\"puma\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-qpgp-93vx-g8v8/GHSA-qpgp-93vx-g8v8.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion \"},{\"advisory\":\"https://github.com/advisories/GHSA-gm2x-2g9h-ccm8\",\"aliases\":[\"CVE-2026-33762\"],\"commit\":\"https://github.com/github/advisory-database/commit/cde59b3a8eabd10e036a1898a338bd463ae26b06\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/cde59b3a8eabd10e036a1898a338bd463ae26b06/advisories/github-reviewed/2026/03/GHSA-gm2x-2g9h-ccm8/GHSA-gm2x-2g9h-ccm8.json\",\"id\":\"GHSA-gm2x-2g9h-ccm8\",\"packages\":[\"github.com/go-git/go-git/v5\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-gm2x-2g9h-ccm8/GHSA-gm2x-2g9h-ccm8.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"go-git missing validation decoding Index v4 files leads to panic\"},{\"advisory\":\"https://github.com/advisories/GHSA-79qf-vqgc-7xx3\",\"aliases\":[\"CVE-2026-63667\"],\"commit\":\"https://github.com/github/advisory-database/commit/bf47def862a58277316e0fb670b9da02328bea6b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/bf47def862a58277316e0fb670b9da02328bea6b/advisories/github-reviewed/2026/09/GHSA-79qf-vqgc-7xx3/GHSA-79qf-vqgc-7xx3.json\",\"id\":\"GHSA-79qf-vqgc-7xx3\",\"packages\":[\"@apostrophecms/import-export\"],\"path\":\"advisories/github-reviewed/2026/09/GHSA-79qf-vqgc-7xx3/GHSA-79qf-vqgc-7xx3.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal\"},{\"advisory\":\"https://github.com/advisories/GHSA-wg36-wvj6-r67p\",\"aliases\":[\"CVE-2026-40176\"],\"commit\":\"https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/04/GHSA-wg36-wvj6-r67p/GHSA-wg36-wvj6-r67p.json\",\"id\":\"GHSA-wg36-wvj6-r67p\",\"packages\":[\"composer/composer\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-wg36-wvj6-r67p/GHSA-wg36-wvj6-r67p.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Composer has a command injection via malicious perforce repository\"},{\"advisory\":\"https://github.com/advisories/GHSA-2p5x-4jr6-x5jg\",\"aliases\":[\"CVE-2026-45263\"],\"commit\":\"https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-2p5x-4jr6-x5jg/GHSA-2p5x-4jr6-x5jg.json\",\"id\":\"GHSA-2p5x-4jr6-x5jg\",\"packages\":[\"facturascripts/facturascripts\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-2p5x-4jr6-x5jg/GHSA-2p5x-4jr6-x5jg.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export\"},{\"advisory\":\"https://github.com/advisories/GHSA-5qmh-x653-g8qj\",\"aliases\":[\"CVE-2026-45262\"],\"commit\":\"https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-5qmh-x653-g8qj/GHSA-5qmh-x653-g8qj.json\",\"id\":\"GHSA-5qmh-x653-g8qj\",\"packages\":[\"facturascripts/facturascripts\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-5qmh-x653-g8qj/GHSA-5qmh-x653-g8qj.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`\"},{\"advisory\":\"https://github.com/advisories/GHSA-hgjx-r89m-m7v4\",\"aliases\":[\"CVE-2026-77526\"],\"commit\":\"https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-hgjx-r89m-m7v4/GHSA-hgjx-r89m-m7v4.json\",\"id\":\"GHSA-hgjx-r89m-m7v4\",\"packages\":[\"facturascripts/facturascripts\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-hgjx-r89m-m7v4/GHSA-hgjx-r89m-m7v4.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() \u2014 arbitrary file write outside MyFiles/ leading to   RCE\"},{\"advisory\":\"https://github.com/advisories/GHSA-6hcw-qqr8-pjj8\",\"aliases\":[\"CVE-2026-40961\"],\"commit\":\"https://github.com/github/advisory-database/commit/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964/advisories/github-reviewed/2026/06/GHSA-6hcw-qqr8-pjj8/GHSA-6hcw-qqr8-pjj8.json\",\"id\":\"GHSA-6hcw-qqr8-pjj8\",\"packages\":[\"apache-airflow\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-6hcw-qqr8-pjj8/GHSA-6hcw-qqr8-pjj8.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Apache Airflow: Authenticated users can bypass the `is_safe_url` check\"},{\"advisory\":\"https://github.com/advisories/GHSA-r4q5-vmmm-2653\",\"aliases\":[\"CVE-2026-40895\"],\"commit\":\"https://github.com/github/advisory-database/commit/5dc5b0acd7f8e64312f23715f299fee0e0b92710\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/5dc5b0acd7f8e64312f23715f299fee0e0b92710/advisories/github-reviewed/2026/04/GHSA-r4q5-vmmm-2653/GHSA-r4q5-vmmm-2653.json\",\"id\":\"GHSA-r4q5-vmmm-2653\",\"packages\":[\"follow-redirects\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-r4q5-vmmm-2653/GHSA-r4q5-vmmm-2653.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets\"}],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 2, 2026, GitHub's security advisory list published 2 new advisories, changed 16, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "", "txHash": "0xbe7125794b53b6deca06ad524b615bff78676ec8ec00feac4b9eb8e5e017d9d3", "receiptUrl": "https://flare-explorer.flare.network/tx/0xbe7125794b53b6deca06ad524b615bff78676ec8ec00feac4b9eb8e5e017d9d3", "blockNumber": 73609129, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": [], "parsed": {"counts": {"changed": 16, "published": 2, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-02", "kind": "watch-day", "recordedAt": "2026-11-03T01:01:39Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-f9j6-8p6x-r9j6", "aliases": ["CVE-2026-62374"], "commit": "https://github.com/github/advisory-database/commit/714474ad30864fbfc71ec0cefc1a454bb23763f9", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/714474ad30864fbfc71ec0cefc1a454bb23763f9/advisories/github-reviewed/2026/11/GHSA-f9j6-8p6x-r9j6/GHSA-f9j6-8p6x-r9j6.json", "id": "GHSA-f9j6-8p6x-r9j6", "packages": ["@sd-jwt/decode", "@sd-jwt/core"], "path": "advisories/github-reviewed/2026/11/GHSA-f9j6-8p6x-r9j6/GHSA-f9j6-8p6x-r9j6.json", "severity": "HIGH", "status": "published", "summary": "SD JWT JS: Tampered disclosures silently dropped instead of rejected"}, {"advisory": "https://github.com/advisories/GHSA-j656-3hf2-fvjc", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c/advisories/github-reviewed/2026/11/GHSA-j656-3hf2-fvjc/GHSA-j656-3hf2-fvjc.json", "id": "GHSA-j656-3hf2-fvjc", "packages": ["@bytebase/dbhub"], "path": "advisories/github-reviewed/2026/11/GHSA-j656-3hf2-fvjc/GHSA-j656-3hf2-fvjc.json", "severity": "MODERATE", "status": "published", "summary": "DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation"}, {"advisory": "https://github.com/advisories/GHSA-593v-wcqx-hq2w", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/fc5d42155fec5ec1d99600e0116af511fb281c9d", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/fc5d42155fec5ec1d99600e0116af511fb281c9d/advisories/github-reviewed/2021/09/GHSA-593v-wcqx-hq2w/GHSA-593v-wcqx-hq2w.json", "id": "GHSA-593v-wcqx-hq2w", "packages": ["parse-server"], "path": "advisories/github-reviewed/2021/09/GHSA-593v-wcqx-hq2w/GHSA-593v-wcqx-hq2w.json", "severity": "HIGH", "status": "changed", "summary": "Incorrect version tags linked to external repository"}, {"advisory": "https://github.com/advisories/GHSA-62gx-5q78-wrvx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/1d4cd95343cec306ca25af2ff701101a186a82a7", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1d4cd95343cec306ca25af2ff701101a186a82a7/advisories/github-reviewed/2026/07/GHSA-62gx-5q78-wrvx/GHSA-62gx-5q78-wrvx.json", "id": "GHSA-62gx-5q78-wrvx", "packages": ["obsidian-local-rest-api"], "path": "advisories/github-reviewed/2026/07/GHSA-62gx-5q78-wrvx/GHSA-62gx-5q78-wrvx.json", "severity": "HIGH", "status": "changed", "summary": "obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} \u2014 arbitrary host file read/write/delete"}, {"advisory": "https://github.com/advisories/GHSA-wcjj-9m6g-2fr2", "aliases": ["CVE-2026-59176"], "commit": "https://github.com/github/advisory-database/commit/c99b68a106442b6fa5d954af56dd58c59c4e8617", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/c99b68a106442b6fa5d954af56dd58c59c4e8617/advisories/github-reviewed/2026/09/GHSA-wcjj-9m6g-2fr2/GHSA-wcjj-9m6g-2fr2.json", "id": "GHSA-wcjj-9m6g-2fr2", "packages": ["functype-mcp-server"], "path": "advisories/github-reviewed/2026/09/GHSA-wcjj-9m6g-2fr2/GHSA-wcjj-9m6g-2fr2.json", "severity": "HIGH", "status": "changed", "summary": "functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import"}, {"advisory": "https://github.com/advisories/GHSA-2x63-gw47-w4mm", "aliases": ["CVE-2026-61666"], "commit": "https://github.com/github/advisory-database/commit/b5542e1d1ef8751817ac573f83d4433c852ede80", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/b5542e1d1ef8751817ac573f83d4433c852ede80/advisories/github-reviewed/2026/07/GHSA-2x63-gw47-w4mm/GHSA-2x63-gw47-w4mm.json", "id": "GHSA-2x63-gw47-w4mm", "packages": ["websocket-driver"], "path": "advisories/github-reviewed/2026/07/GHSA-2x63-gw47-w4mm/GHSA-2x63-gw47-w4mm.json", "severity": "HIGH", "status": "changed", "summary": "websocket-driver-ruby: Denial of service via malformed Host header"}, {"advisory": "https://github.com/advisories/GHSA-crwc-vw2r-qr6m", "aliases": ["CVE-2026-113730"], "commit": "https://github.com/github/advisory-database/commit/1e24e5f4b872224ded9288b412cea0b5957cdb5e", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/1e24e5f4b872224ded9288b412cea0b5957cdb5e/advisories/github-reviewed/2026/10/GHSA-crwc-vw2r-qr6m/GHSA-crwc-vw2r-qr6m.json", "id": "GHSA-crwc-vw2r-qr6m", "packages": ["ognl:ognl"], "path": "advisories/github-reviewed/2026/10/GHSA-crwc-vw2r-qr6m/GHSA-crwc-vw2r-qr6m.json", "severity": "MODERATE", "status": "changed", "summary": "OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies"}, {"advisory": "https://github.com/advisories/GHSA-8mgp-746c-j5xp", "aliases": ["CVE-2026-81726"], "commit": "https://github.com/github/advisory-database/commit/fc9a22d2ae88d6a10dda69215596c9400648ba9e", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/fc9a22d2ae88d6a10dda69215596c9400648ba9e/advisories/github-reviewed/2026/09/GHSA-8mgp-746c-j5xp/GHSA-8mgp-746c-j5xp.json", "id": "GHSA-8mgp-746c-j5xp", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/09/GHSA-8mgp-746c-j5xp/GHSA-8mgp-746c-j5xp.json", "severity": "HIGH", "status": "changed", "summary": "NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots"}, {"advisory": "https://github.com/advisories/GHSA-2vqw-3mp8-cgmx", "aliases": ["CVE-2026-47737"], "commit": "https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-2vqw-3mp8-cgmx/GHSA-2vqw-3mp8-cgmx.json", "id": "GHSA-2vqw-3mp8-cgmx", "packages": ["puma"], "path": "advisories/github-reviewed/2026/06/GHSA-2vqw-3mp8-cgmx/GHSA-2vqw-3mp8-cgmx.json", "severity": "HIGH", "status": "changed", "summary": "Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections"}, {"advisory": "https://github.com/advisories/GHSA-qpgp-93vx-g8v8", "aliases": ["CVE-2026-47736"], "commit": "https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-qpgp-93vx-g8v8/GHSA-qpgp-93vx-g8v8.json", "id": "GHSA-qpgp-93vx-g8v8", "packages": ["puma"], "path": "advisories/github-reviewed/2026/06/GHSA-qpgp-93vx-g8v8/GHSA-qpgp-93vx-g8v8.json", "severity": "HIGH", "status": "changed", "summary": "Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion "}, {"advisory": "https://github.com/advisories/GHSA-gm2x-2g9h-ccm8", "aliases": ["CVE-2026-33762"], "commit": "https://github.com/github/advisory-database/commit/cde59b3a8eabd10e036a1898a338bd463ae26b06", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/cde59b3a8eabd10e036a1898a338bd463ae26b06/advisories/github-reviewed/2026/03/GHSA-gm2x-2g9h-ccm8/GHSA-gm2x-2g9h-ccm8.json", "id": "GHSA-gm2x-2g9h-ccm8", "packages": ["github.com/go-git/go-git/v5"], "path": "advisories/github-reviewed/2026/03/GHSA-gm2x-2g9h-ccm8/GHSA-gm2x-2g9h-ccm8.json", "severity": "LOW", "status": "changed", "summary": "go-git missing validation decoding Index v4 files leads to panic"}, {"advisory": "https://github.com/advisories/GHSA-79qf-vqgc-7xx3", "aliases": ["CVE-2026-63667"], "commit": "https://github.com/github/advisory-database/commit/bf47def862a58277316e0fb670b9da02328bea6b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/bf47def862a58277316e0fb670b9da02328bea6b/advisories/github-reviewed/2026/09/GHSA-79qf-vqgc-7xx3/GHSA-79qf-vqgc-7xx3.json", "id": "GHSA-79qf-vqgc-7xx3", "packages": ["@apostrophecms/import-export"], "path": "advisories/github-reviewed/2026/09/GHSA-79qf-vqgc-7xx3/GHSA-79qf-vqgc-7xx3.json", "severity": "MODERATE", "status": "changed", "summary": "ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal"}, {"advisory": "https://github.com/advisories/GHSA-wg36-wvj6-r67p", "aliases": ["CVE-2026-40176"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/04/GHSA-wg36-wvj6-r67p/GHSA-wg36-wvj6-r67p.json", "id": "GHSA-wg36-wvj6-r67p", "packages": ["composer/composer"], "path": "advisories/github-reviewed/2026/04/GHSA-wg36-wvj6-r67p/GHSA-wg36-wvj6-r67p.json", "severity": "HIGH", "status": "changed", "summary": "Composer has a command injection via malicious perforce repository"}, {"advisory": "https://github.com/advisories/GHSA-2p5x-4jr6-x5jg", "aliases": ["CVE-2026-45263"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-2p5x-4jr6-x5jg/GHSA-2p5x-4jr6-x5jg.json", "id": "GHSA-2p5x-4jr6-x5jg", "packages": ["facturascripts/facturascripts"], "path": "advisories/github-reviewed/2026/07/GHSA-2p5x-4jr6-x5jg/GHSA-2p5x-4jr6-x5jg.json", "severity": "HIGH", "status": "changed", "summary": "FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export"}, {"advisory": "https://github.com/advisories/GHSA-5qmh-x653-g8qj", "aliases": ["CVE-2026-45262"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-5qmh-x653-g8qj/GHSA-5qmh-x653-g8qj.json", "id": "GHSA-5qmh-x653-g8qj", "packages": ["facturascripts/facturascripts"], "path": "advisories/github-reviewed/2026/07/GHSA-5qmh-x653-g8qj/GHSA-5qmh-x653-g8qj.json", "severity": "CRITICAL", "status": "changed", "summary": "FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`"}, {"advisory": "https://github.com/advisories/GHSA-hgjx-r89m-m7v4", "aliases": ["CVE-2026-77526"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-hgjx-r89m-m7v4/GHSA-hgjx-r89m-m7v4.json", "id": "GHSA-hgjx-r89m-m7v4", "packages": ["facturascripts/facturascripts"], "path": "advisories/github-reviewed/2026/07/GHSA-hgjx-r89m-m7v4/GHSA-hgjx-r89m-m7v4.json", "severity": "CRITICAL", "status": "changed", "summary": "FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() \u2014 arbitrary file write outside MyFiles/ leading to   RCE"}, {"advisory": "https://github.com/advisories/GHSA-6hcw-qqr8-pjj8", "aliases": ["CVE-2026-40961"], "commit": "https://github.com/github/advisory-database/commit/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964/advisories/github-reviewed/2026/06/GHSA-6hcw-qqr8-pjj8/GHSA-6hcw-qqr8-pjj8.json", "id": "GHSA-6hcw-qqr8-pjj8", "packages": ["apache-airflow"], "path": "advisories/github-reviewed/2026/06/GHSA-6hcw-qqr8-pjj8/GHSA-6hcw-qqr8-pjj8.json", "severity": "HIGH", "status": "changed", "summary": "Apache Airflow: Authenticated users can bypass the `is_safe_url` check"}, {"advisory": "https://github.com/advisories/GHSA-r4q5-vmmm-2653", "aliases": ["CVE-2026-40895"], "commit": "https://github.com/github/advisory-database/commit/5dc5b0acd7f8e64312f23715f299fee0e0b92710", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/5dc5b0acd7f8e64312f23715f299fee0e0b92710/advisories/github-reviewed/2026/04/GHSA-r4q5-vmmm-2653/GHSA-r4q5-vmmm-2653.json", "id": "GHSA-r4q5-vmmm-2653", "packages": ["follow-redirects"], "path": "advisories/github-reviewed/2026/04/GHSA-r4q5-vmmm-2653/GHSA-r4q5-vmmm-2653.json", "severity": "MODERATE", "status": "changed", "summary": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets"}], "sourceId": "advisories-reviewed", "text": "On November 2, 2026, GitHub's security advisory list published 2 new advisories, changed 16, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1}}, "parsed": {"counts": {"changed": 16, "published": 2, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-02", "kind": "watch-day", "recordedAt": "2026-11-03T01:01:39Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-f9j6-8p6x-r9j6", "aliases": ["CVE-2026-62374"], "commit": "https://github.com/github/advisory-database/commit/714474ad30864fbfc71ec0cefc1a454bb23763f9", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/714474ad30864fbfc71ec0cefc1a454bb23763f9/advisories/github-reviewed/2026/11/GHSA-f9j6-8p6x-r9j6/GHSA-f9j6-8p6x-r9j6.json", "id": "GHSA-f9j6-8p6x-r9j6", "packages": ["@sd-jwt/decode", "@sd-jwt/core"], "path": "advisories/github-reviewed/2026/11/GHSA-f9j6-8p6x-r9j6/GHSA-f9j6-8p6x-r9j6.json", "severity": "HIGH", "status": "published", "summary": "SD JWT JS: Tampered disclosures silently dropped instead of rejected"}, {"advisory": "https://github.com/advisories/GHSA-j656-3hf2-fvjc", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c/advisories/github-reviewed/2026/11/GHSA-j656-3hf2-fvjc/GHSA-j656-3hf2-fvjc.json", "id": "GHSA-j656-3hf2-fvjc", "packages": ["@bytebase/dbhub"], "path": "advisories/github-reviewed/2026/11/GHSA-j656-3hf2-fvjc/GHSA-j656-3hf2-fvjc.json", "severity": "MODERATE", "status": "published", "summary": "DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation"}, {"advisory": "https://github.com/advisories/GHSA-593v-wcqx-hq2w", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/fc5d42155fec5ec1d99600e0116af511fb281c9d", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/fc5d42155fec5ec1d99600e0116af511fb281c9d/advisories/github-reviewed/2021/09/GHSA-593v-wcqx-hq2w/GHSA-593v-wcqx-hq2w.json", "id": "GHSA-593v-wcqx-hq2w", "packages": ["parse-server"], "path": "advisories/github-reviewed/2021/09/GHSA-593v-wcqx-hq2w/GHSA-593v-wcqx-hq2w.json", "severity": "HIGH", "status": "changed", "summary": "Incorrect version tags linked to external repository"}, {"advisory": "https://github.com/advisories/GHSA-62gx-5q78-wrvx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/1d4cd95343cec306ca25af2ff701101a186a82a7", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1d4cd95343cec306ca25af2ff701101a186a82a7/advisories/github-reviewed/2026/07/GHSA-62gx-5q78-wrvx/GHSA-62gx-5q78-wrvx.json", "id": "GHSA-62gx-5q78-wrvx", "packages": ["obsidian-local-rest-api"], "path": "advisories/github-reviewed/2026/07/GHSA-62gx-5q78-wrvx/GHSA-62gx-5q78-wrvx.json", "severity": "HIGH", "status": "changed", "summary": "obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} \u2014 arbitrary host file read/write/delete"}, {"advisory": "https://github.com/advisories/GHSA-wcjj-9m6g-2fr2", "aliases": ["CVE-2026-59176"], "commit": "https://github.com/github/advisory-database/commit/c99b68a106442b6fa5d954af56dd58c59c4e8617", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/c99b68a106442b6fa5d954af56dd58c59c4e8617/advisories/github-reviewed/2026/09/GHSA-wcjj-9m6g-2fr2/GHSA-wcjj-9m6g-2fr2.json", "id": "GHSA-wcjj-9m6g-2fr2", "packages": ["functype-mcp-server"], "path": "advisories/github-reviewed/2026/09/GHSA-wcjj-9m6g-2fr2/GHSA-wcjj-9m6g-2fr2.json", "severity": "HIGH", "status": "changed", "summary": "functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import"}, {"advisory": "https://github.com/advisories/GHSA-2x63-gw47-w4mm", "aliases": ["CVE-2026-61666"], "commit": "https://github.com/github/advisory-database/commit/b5542e1d1ef8751817ac573f83d4433c852ede80", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/b5542e1d1ef8751817ac573f83d4433c852ede80/advisories/github-reviewed/2026/07/GHSA-2x63-gw47-w4mm/GHSA-2x63-gw47-w4mm.json", "id": "GHSA-2x63-gw47-w4mm", "packages": ["websocket-driver"], "path": "advisories/github-reviewed/2026/07/GHSA-2x63-gw47-w4mm/GHSA-2x63-gw47-w4mm.json", "severity": "HIGH", "status": "changed", "summary": "websocket-driver-ruby: Denial of service via malformed Host header"}, {"advisory": "https://github.com/advisories/GHSA-crwc-vw2r-qr6m", "aliases": ["CVE-2026-113730"], "commit": "https://github.com/github/advisory-database/commit/1e24e5f4b872224ded9288b412cea0b5957cdb5e", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/1e24e5f4b872224ded9288b412cea0b5957cdb5e/advisories/github-reviewed/2026/10/GHSA-crwc-vw2r-qr6m/GHSA-crwc-vw2r-qr6m.json", "id": "GHSA-crwc-vw2r-qr6m", "packages": ["ognl:ognl"], "path": "advisories/github-reviewed/2026/10/GHSA-crwc-vw2r-qr6m/GHSA-crwc-vw2r-qr6m.json", "severity": "MODERATE", "status": "changed", "summary": "OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies"}, {"advisory": "https://github.com/advisories/GHSA-8mgp-746c-j5xp", "aliases": ["CVE-2026-81726"], "commit": "https://github.com/github/advisory-database/commit/fc9a22d2ae88d6a10dda69215596c9400648ba9e", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/fc9a22d2ae88d6a10dda69215596c9400648ba9e/advisories/github-reviewed/2026/09/GHSA-8mgp-746c-j5xp/GHSA-8mgp-746c-j5xp.json", "id": "GHSA-8mgp-746c-j5xp", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/09/GHSA-8mgp-746c-j5xp/GHSA-8mgp-746c-j5xp.json", "severity": "HIGH", "status": "changed", "summary": "NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots"}, {"advisory": "https://github.com/advisories/GHSA-2vqw-3mp8-cgmx", "aliases": ["CVE-2026-47737"], "commit": "https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-2vqw-3mp8-cgmx/GHSA-2vqw-3mp8-cgmx.json", "id": "GHSA-2vqw-3mp8-cgmx", "packages": ["puma"], "path": "advisories/github-reviewed/2026/06/GHSA-2vqw-3mp8-cgmx/GHSA-2vqw-3mp8-cgmx.json", "severity": "HIGH", "status": "changed", "summary": "Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections"}, {"advisory": "https://github.com/advisories/GHSA-qpgp-93vx-g8v8", "aliases": ["CVE-2026-47736"], "commit": "https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-qpgp-93vx-g8v8/GHSA-qpgp-93vx-g8v8.json", "id": "GHSA-qpgp-93vx-g8v8", "packages": ["puma"], "path": "advisories/github-reviewed/2026/06/GHSA-qpgp-93vx-g8v8/GHSA-qpgp-93vx-g8v8.json", "severity": "HIGH", "status": "changed", "summary": "Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion "}, {"advisory": "https://github.com/advisories/GHSA-gm2x-2g9h-ccm8", "aliases": ["CVE-2026-33762"], "commit": "https://github.com/github/advisory-database/commit/cde59b3a8eabd10e036a1898a338bd463ae26b06", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/cde59b3a8eabd10e036a1898a338bd463ae26b06/advisories/github-reviewed/2026/03/GHSA-gm2x-2g9h-ccm8/GHSA-gm2x-2g9h-ccm8.json", "id": "GHSA-gm2x-2g9h-ccm8", "packages": ["github.com/go-git/go-git/v5"], "path": "advisories/github-reviewed/2026/03/GHSA-gm2x-2g9h-ccm8/GHSA-gm2x-2g9h-ccm8.json", "severity": "LOW", "status": "changed", "summary": "go-git missing validation decoding Index v4 files leads to panic"}, {"advisory": "https://github.com/advisories/GHSA-79qf-vqgc-7xx3", "aliases": ["CVE-2026-63667"], "commit": "https://github.com/github/advisory-database/commit/bf47def862a58277316e0fb670b9da02328bea6b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/bf47def862a58277316e0fb670b9da02328bea6b/advisories/github-reviewed/2026/09/GHSA-79qf-vqgc-7xx3/GHSA-79qf-vqgc-7xx3.json", "id": "GHSA-79qf-vqgc-7xx3", "packages": ["@apostrophecms/import-export"], "path": "advisories/github-reviewed/2026/09/GHSA-79qf-vqgc-7xx3/GHSA-79qf-vqgc-7xx3.json", "severity": "MODERATE", "status": "changed", "summary": "ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal"}, {"advisory": "https://github.com/advisories/GHSA-wg36-wvj6-r67p", "aliases": ["CVE-2026-40176"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/04/GHSA-wg36-wvj6-r67p/GHSA-wg36-wvj6-r67p.json", "id": "GHSA-wg36-wvj6-r67p", "packages": ["composer/composer"], "path": "advisories/github-reviewed/2026/04/GHSA-wg36-wvj6-r67p/GHSA-wg36-wvj6-r67p.json", "severity": "HIGH", "status": "changed", "summary": "Composer has a command injection via malicious perforce repository"}, {"advisory": "https://github.com/advisories/GHSA-2p5x-4jr6-x5jg", "aliases": ["CVE-2026-45263"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-2p5x-4jr6-x5jg/GHSA-2p5x-4jr6-x5jg.json", "id": "GHSA-2p5x-4jr6-x5jg", "packages": ["facturascripts/facturascripts"], "path": "advisories/github-reviewed/2026/07/GHSA-2p5x-4jr6-x5jg/GHSA-2p5x-4jr6-x5jg.json", "severity": "HIGH", "status": "changed", "summary": "FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export"}, {"advisory": "https://github.com/advisories/GHSA-5qmh-x653-g8qj", "aliases": ["CVE-2026-45262"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-5qmh-x653-g8qj/GHSA-5qmh-x653-g8qj.json", "id": "GHSA-5qmh-x653-g8qj", "packages": ["facturascripts/facturascripts"], "path": "advisories/github-reviewed/2026/07/GHSA-5qmh-x653-g8qj/GHSA-5qmh-x653-g8qj.json", "severity": "CRITICAL", "status": "changed", "summary": "FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`"}, {"advisory": "https://github.com/advisories/GHSA-hgjx-r89m-m7v4", "aliases": ["CVE-2026-77526"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-hgjx-r89m-m7v4/GHSA-hgjx-r89m-m7v4.json", "id": "GHSA-hgjx-r89m-m7v4", "packages": ["facturascripts/facturascripts"], "path": "advisories/github-reviewed/2026/07/GHSA-hgjx-r89m-m7v4/GHSA-hgjx-r89m-m7v4.json", "severity": "CRITICAL", "status": "changed", "summary": "FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() \u2014 arbitrary file write outside MyFiles/ leading to   RCE"}, {"advisory": "https://github.com/advisories/GHSA-6hcw-qqr8-pjj8", "aliases": ["CVE-2026-40961"], "commit": "https://github.com/github/advisory-database/commit/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964/advisories/github-reviewed/2026/06/GHSA-6hcw-qqr8-pjj8/GHSA-6hcw-qqr8-pjj8.json", "id": "GHSA-6hcw-qqr8-pjj8", "packages": ["apache-airflow"], "path": "advisories/github-reviewed/2026/06/GHSA-6hcw-qqr8-pjj8/GHSA-6hcw-qqr8-pjj8.json", "severity": "HIGH", "status": "changed", "summary": "Apache Airflow: Authenticated users can bypass the `is_safe_url` check"}, {"advisory": "https://github.com/advisories/GHSA-r4q5-vmmm-2653", "aliases": ["CVE-2026-40895"], "commit": "https://github.com/github/advisory-database/commit/5dc5b0acd7f8e64312f23715f299fee0e0b92710", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/5dc5b0acd7f8e64312f23715f299fee0e0b92710/advisories/github-reviewed/2026/04/GHSA-r4q5-vmmm-2653/GHSA-r4q5-vmmm-2653.json", "id": "GHSA-r4q5-vmmm-2653", "packages": ["follow-redirects"], "path": "advisories/github-reviewed/2026/04/GHSA-r4q5-vmmm-2653/GHSA-r4q5-vmmm-2653.json", "severity": "MODERATE", "status": "changed", "summary": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets"}], "sourceId": "advisories-reviewed", "text": "On November 2, 2026, GitHub's security advisory list published 2 new advisories, changed 16, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1}, "project": {"projectId": 20, "name": "Security advisories (GitHub reviewed)", "kind": "watch", "keeper": "GitHub", "jurisdiction": "", "markText": "GH", "shape": "", "what": "GitHub's security advisory list", "repoUrl": "https://github.com/github/advisory-database", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "chunk": "day"}, "date": "2026-11-03", "author": {"name": "Flare Reef watcher", "handle": "", "verified": false}}