{"note": {"noteId": 418, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0xa18511b6f0003f52059d55643c009de6c90a0c4ecb5b86445a968b14a3920d30", "content": "{\"counts\":{\"changed\":29,\"published\":22,\"removed\":0,\"withdrawn\":1},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-03\",\"fullList\":{\"bytes\":40531,\"fingerprint\":\"59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc\",\"url\":\"https://flarereef.flareforward.com/files/watch/59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc.json\"},\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-04T02:17:13Z\",\"rows\":[{\"advisory\":\"https://github.com/advisories/GHSA-wp3j-xq48-xpjw\",\"aliases\":[\"CVE-2025-9566\"],\"commit\":\"https://github.com/github/advisory-database/commit/887dcb68f13a7d9be8bf3d604c2e32fc3d6960e8\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/887dcb68f13a7d9be8bf3d604c2e32fc3d6960e8/advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json\",\"id\":\"GHSA-wp3j-xq48-xpjw\",\"packages\":[\"github.com/containers/podman/v5\",\"github.com/containers/podman/v4\"],\"path\":\"advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"podman kube play symlink traversal vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-v653-r55g-hcmg\",\"aliases\":[\"CVE-2025-13327\"],\"commit\":\"https://github.com/github/advisory-database/commit/109512409477d1b7dfa372b0346a28a59d47e04d\",\"ecosystems\":[\"crates.io\"],\"file\":\"https://github.com/github/advisory-database/blob/109512409477d1b7dfa372b0346a28a59d47e04d/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json\",\"id\":\"GHSA-v653-r55g-hcmg\",\"packages\":[\"uv\"],\"path\":\"advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"uv has ZIP payload obfuscation through parsing differentials\"},{\"advisory\":\"https://github.com/advisories/GHSA-f23m-r3pf-42rh\",\"aliases\":[\"CVE-2026-2950\"],\"commit\":\"https://github.com/github/advisory-database/commit/0b1941f7d05b03f4ed6469b0236dd3c59357f497\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/0b1941f7d05b03f4ed6469b0236dd3c59357f497/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json\",\"id\":\"GHSA-f23m-r3pf-42rh\",\"packages\":[\"lodash\",\"lodash-es\",\"lodash-amd\",\"lodash.unset\",\"lodash.omit\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt\"},{\"advisory\":\"https://github.com/advisories/GHSA-2cvf-wqm6-wr9g\",\"aliases\":[\"CVE-2026-94603\"],\"commit\":\"https://github.com/github/advisory-database/commit/b9d5dfa2061837f892e2cdbecfe33751bcd902fa\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/b9d5dfa2061837f892e2cdbecfe33751bcd902fa/advisories/github-reviewed/2026/10/GHSA-2cvf-wqm6-wr9g/GHSA-2cvf-wqm6-wr9g.json\",\"id\":\"GHSA-2cvf-wqm6-wr9g\",\"packages\":[\"github.com/containers/podman/v4\",\"go.podman.io/podman/v6\",\"github.com/containers/podman/v5\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-2cvf-wqm6-wr9g/GHSA-2cvf-wqm6-wr9g.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation\"},{\"advisory\":\"https://github.com/advisories/GHSA-23f4-hfmq-94mj\",\"aliases\":[\"CVE-2026-24807\"],\"commit\":\"https://github.com/github/advisory-database/commit/1cd5f193871f6f187dcd0bb684096313535d13dc\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/1cd5f193871f6f187dcd0bb684096313535d13dc/advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json\",\"id\":\"GHSA-23f4-hfmq-94mj\",\"packages\":[\"com.github.liuyueyi.media:batik-codec-fix\"],\"path\":\"advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec\"},{\"advisory\":\"https://github.com/advisories/GHSA-4c5c-2vc3-x5w2\",\"aliases\":[\"CVE-2024-27928\"],\"commit\":\"https://github.com/github/advisory-database/commit/09a0c50f4c060b454b1beba39b06607b692ae442\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/09a0c50f4c060b454b1beba39b06607b692ae442/advisories/github-reviewed/2026/06/GHSA-4c5c-2vc3-x5w2/GHSA-4c5c-2vc3-x5w2.json\",\"id\":\"GHSA-4c5c-2vc3-x5w2\",\"packages\":[\"vantage6\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-4c5c-2vc3-x5w2/GHSA-4c5c-2vc3-x5w2.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Vantage6: 2FA can be circumvented with hacked email access\"},{\"advisory\":\"https://github.com/advisories/GHSA-5549-c5q7-fj65\",\"aliases\":[\"CVE-2024-24769\"],\"commit\":\"https://github.com/github/advisory-database/commit/3ad38b79a298df87ea7277ef69a97bdf8ac19070\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/3ad38b79a298df87ea7277ef69a97bdf8ac19070/advisories/github-reviewed/2026/06/GHSA-5549-c5q7-fj65/GHSA-5549-c5q7-fj65.json\",\"id\":\"GHSA-5549-c5q7-fj65\",\"packages\":[\"vantage6\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-5549-c5q7-fj65/GHSA-5549-c5q7-fj65.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"Vantage6: No limit on emails sent for password/MFA reset\"},{\"advisory\":\"https://github.com/advisories/GHSA-gg2p-37pv-v7fq\",\"aliases\":[\"CVE-2026-18948\"],\"commit\":\"https://github.com/github/advisory-database/commit/2f5c9c3dc515527cf27c5dea15ea0c286b09a6a1\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/2f5c9c3dc515527cf27c5dea15ea0c286b09a6a1/advisories/github-reviewed/2026/08/GHSA-gg2p-37pv-v7fq/GHSA-gg2p-37pv-v7fq.json\",\"id\":\"GHSA-gg2p-37pv-v7fq\",\"packages\":[\"feast\"],\"path\":\"advisories/github-reviewed/2026/08/GHSA-gg2p-37pv-v7fq/GHSA-gg2p-37pv-v7fq.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs\"},{\"advisory\":\"https://github.com/advisories/GHSA-263q-5cv3-xq9g\",\"aliases\":[\"CVE-2025-68939\"],\"commit\":\"https://github.com/github/advisory-database/commit/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3/advisories/github-reviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json\",\"id\":\"GHSA-263q-5cv3-xq9g\",\"packages\":[\"code.gitea.io/gitea\"],\"path\":\"advisories/github-reviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Gitea allows attackers to add attachments with forbidden file extensions\"},{\"advisory\":\"https://github.com/advisories/GHSA-2fqr-mr3j-6wp8\",\"aliases\":[\"CVE-2026-54279\"],\"commit\":\"https://github.com/github/advisory-database/commit/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3/advisories/github-reviewed/2026/06/GHSA-2fqr-mr3j-6wp8/GHSA-2fqr-mr3j-6wp8.json\",\"id\":\"GHSA-2fqr-mr3j-6wp8\",\"packages\":[\"aiohttp\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-2fqr-mr3j-6wp8/GHSA-2fqr-mr3j-6wp8.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence\"},{\"advisory\":\"https://github.com/advisories/GHSA-m3qr-fvp4-78xj\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/20d31bd4c8caa6b82129e0d004e578e5cebe8f91\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/20d31bd4c8caa6b82129e0d004e578e5cebe8f91/advisories/github-reviewed/2026/11/GHSA-m3qr-fvp4-78xj/GHSA-m3qr-fvp4-78xj.json\",\"id\":\"GHSA-m3qr-fvp4-78xj\",\"packages\":[\"github.com/basekick-labs/arc\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-m3qr-fvp4-78xj/GHSA-m3qr-fvp4-78xj.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Arc has unauthenticated application log disclosure via `/api/v1/logs`\"},{\"advisory\":\"https://github.com/advisories/GHSA-h26j-4vp7-x9w2\",\"aliases\":[\"CVE-2026-62848\"],\"commit\":\"https://github.com/github/advisory-database/commit/5742631ca9236a1b99fb823b7dc5746894dc9c97\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/5742631ca9236a1b99fb823b7dc5746894dc9c97/advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json\",\"id\":\"GHSA-h26j-4vp7-x9w2\",\"packages\":[\"Metalama.Framework\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution\"},{\"advisory\":\"https://github.com/advisories/GHSA-9ppr-wfw9-xvr2\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/2c0fc1b40f792460bac314a3589ee722fddf9ab7\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/2c0fc1b40f792460bac314a3589ee722fddf9ab7/advisories/github-reviewed/2026/11/GHSA-9ppr-wfw9-xvr2/GHSA-9ppr-wfw9-xvr2.json\",\"id\":\"GHSA-9ppr-wfw9-xvr2\",\"packages\":[\"github.com/tinfoil-factory/netfoil\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-9ppr-wfw9-xvr2/GHSA-9ppr-wfw9-xvr2.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Netfoil doesn't decrement TTL\"},{\"advisory\":\"https://github.com/advisories/GHSA-g27p-qf6j-c96c\",\"aliases\":[\"CVE-2026-102870\"],\"commit\":\"https://github.com/github/advisory-database/commit/0713d11c551f4fb074272b59e61c545ca28b395e\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/0713d11c551f4fb074272b59e61c545ca28b395e/advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json\",\"id\":\"GHSA-g27p-qf6j-c96c\",\"packages\":[\"Microsoft.AspNetCore.Components.WebAssembly.Server\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-4mpw-cpwj-hxxj\",\"aliases\":[\"CVE-2026-70197\"],\"commit\":\"https://github.com/github/advisory-database/commit/1b2b2b1ca2543a77a29a869f05f5d5ab9a48832d\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/1b2b2b1ca2543a77a29a869f05f5d5ab9a48832d/advisories/github-reviewed/2026/10/GHSA-4mpw-cpwj-hxxj/GHSA-4mpw-cpwj-hxxj.json\",\"id\":\"GHSA-4mpw-cpwj-hxxj\",\"packages\":[\"Microsoft.NETCore.App.Runtime.win-arm64\",\"Microsoft.NETCore.App.Runtime.win-x64\",\"Microsoft.NETCore.App.Runtime.win-x86\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-4mpw-cpwj-hxxj/GHSA-4mpw-cpwj-hxxj.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-9v8h-qqgm-4m35\",\"aliases\":[\"CVE-2026-111497\"],\"commit\":\"https://github.com/github/advisory-database/commit/a8429404393e1324233442f9b6b686fa23906d49\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/a8429404393e1324233442f9b6b686fa23906d49/advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json\",\"id\":\"GHSA-9v8h-qqgm-4m35\",\"packages\":[\"brotli\",\"brotlicffi\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Brotli: Out-of-bounds write in the Brotli decoder (\\\"Node2Shell\\\") also affects the PyPI Brotli package\"},{\"advisory\":\"https://github.com/advisories/GHSA-g27p-qf6j-c96c\",\"aliases\":[\"CVE-2026-102870\"],\"commit\":\"https://github.com/github/advisory-database/commit/a8429404393e1324233442f9b6b686fa23906d49\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/a8429404393e1324233442f9b6b686fa23906d49/advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json\",\"id\":\"GHSA-g27p-qf6j-c96c\",\"packages\":[\"Microsoft.AspNetCore.Components.WebAssembly.Server\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-gqj5-2xp5-3qmp\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/6b4ca00b2205554fe416e66ca4f6bbaa419faff0\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/6b4ca00b2205554fe416e66ca4f6bbaa419faff0/advisories/github-reviewed/2026/06/GHSA-gqj5-2xp5-3qmp/GHSA-gqj5-2xp5-3qmp.json\",\"id\":\"GHSA-gqj5-2xp5-3qmp\",\"packages\":[\"org.keycloak:keycloak-services\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-gqj5-2xp5-3qmp/GHSA-gqj5-2xp5-3qmp.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: Authentication bypass via jwt algorithm confusion\"},{\"advisory\":\"https://github.com/advisories/GHSA-48v2-6jcm-fc99\",\"aliases\":[\"CVE-2026-62331\"],\"commit\":\"https://github.com/github/advisory-database/commit/2b369933cd4a9c17398ae7d4532f48e2ac48c173\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/2b369933cd4a9c17398ae7d4532f48e2ac48c173/advisories/github-reviewed/2026/11/GHSA-48v2-6jcm-fc99/GHSA-48v2-6jcm-fc99.json\",\"id\":\"GHSA-48v2-6jcm-fc99\",\"packages\":[\"github.com/mtzanidakis/praktor\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-48v2-6jcm-fc99/GHSA-48v2-6jcm-fc99.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)\"},{\"advisory\":\"https://github.com/advisories/GHSA-j97h-3f8r-mrjr\",\"aliases\":[\"CVE-2026-11800\"],\"commit\":\"https://github.com/github/advisory-database/commit/2b369933cd4a9c17398ae7d4532f48e2ac48c173\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/2b369933cd4a9c17398ae7d4532f48e2ac48c173/advisories/github-reviewed/2026/11/GHSA-j97h-3f8r-mrjr/GHSA-j97h-3f8r-mrjr.json\",\"id\":\"GHSA-j97h-3f8r-mrjr\",\"packages\":[\"org.keycloak:keycloak-services\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-j97h-3f8r-mrjr/GHSA-j97h-3f8r-mrjr.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Keycloak has authentication bypass via jwt algorithm confusion\"},{\"advisory\":\"https://github.com/advisories/GHSA-p3jp-9v83-76w9\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/772fd8ac4b2e4d12a16d65630979ba79c9a7e82f\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/772fd8ac4b2e4d12a16d65630979ba79c9a7e82f/advisories/github-reviewed/2026/11/GHSA-p3jp-9v83-76w9/GHSA-p3jp-9v83-76w9.json\",\"id\":\"GHSA-p3jp-9v83-76w9\",\"packages\":[\"Microsoft.DotNet.ILCompiler\",\"Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64\",\"Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64\",\"Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64\",\"Microsoft.NETCore.App.Runtime.Mono.android-arm\",\"Microsoft.NETCore.App.Runtime.Mono.android-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.android-x64\",\"Microsoft.NETCore.App.Runtime.Mono.android-x86\",\"Microsoft.NETCore.App.Runtime.Mono.browser-wasm\",\"Microsoft.NETCore.App.Runtime.Mono.ios-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64\",\"Microsoft.NETCore.App.Runtime.Mono.linux-arm\",\"Microsoft.NETCore.App.Runtime.Mono.linux-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64\",\"Microsoft.NETCore.App.Runtime.Mono.linux-x64\",\"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64\",\"Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm\",\"Microsoft.NETCore.App.Runtime.Mono.osx-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.osx-x64\",\"Microsoft.NETCore.App.Runtime.Mono.tvos-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64\",\"Microsoft.NETCore.App.Runtime.Mono.wasi-wasm\",\"Microsoft.NETCore.App.Runtime.Mono.win-x64\",\"Microsoft.NETCore.App.Runtime.Mono.win-x86\",\"Microsoft.NETCore.App.Runtime.linux-arm\",\"Microsoft.NETCore.App.Runtime.linux-arm64\",\"Microsoft.NETCore.App.Runtime.linux-bionic-arm64\",\"Microsoft.NETCore.App.Runtime.linux-bionic-x64\",\"Microsoft.NETCore.App.Runtime.linux-musl-arm\",\"Microsoft.NETCore.App.Runtime.linux-musl-arm64\",\"Microsoft.NETCore.App.Runtime.linux-musl-x64\",\"Microsoft.NETCore.App.Runtime.linux-x64\",\"Microsoft.NETCore.App.Runtime.osx-arm64\",\"Microsoft.NETCore.App.Runtime.osx-x64\",\"Microsoft.NETCore.App.Runtime.win-arm64\",\"Microsoft.NETCore.App.Runtime.win-x64\",\"Microsoft.NETCore.App.Runtime.win-x86\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.win-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.win-x86\",\"Microsoft.NETCore.App.Runtime.NativeAOT.android-arm\",\"Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.android-x64\",\"Microsoft.NETCore.App.Runtime.android-arm64\",\"Microsoft.NETCore.App.Runtime.android-x64\",\"Microsoft.NETCore.App.Runtime.android-arm\",\"Microsoft.NETCore.App.Runtime.browser-wasm\",\"Microsoft.NETCore.App.Runtime.ios-arm64\",\"Microsoft.NETCore.App.Runtime.iossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.iossimulator-x64\",\"Microsoft.NETCore.App.Runtime.maccatalyst-arm64\",\"Microsoft.NETCore.App.Runtime.maccatalyst-x64\",\"Microsoft.NETCore.App.Runtime.tvos-arm64\",\"Microsoft.NETCore.App.Runtime.tvossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.tvossimulator-x64\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-p3jp-9v83-76w9/GHSA-p3jp-9v83-76w9.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-8vvx-qvq9-5948\",\"aliases\":[\"CVE-2025-71338\"],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/03/GHSA-8vvx-qvq9-5948/GHSA-8vvx-qvq9-5948.json\",\"id\":\"GHSA-8vvx-qvq9-5948\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2025/03/GHSA-8vvx-qvq9-5948/GHSA-8vvx-qvq9-5948.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Flowise allows arbitrary file write to RCE\"},{\"advisory\":\"https://github.com/advisories/GHSA-3gf5-cxq9-w223\",\"aliases\":[\"CVE-2025-71340\"],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/08/GHSA-3gf5-cxq9-w223/GHSA-3gf5-cxq9-w223.json\",\"id\":\"GHSA-3gf5-cxq9-w223\",\"packages\":[\"picklescan\"],\"path\":\"advisories/github-reviewed/2025/08/GHSA-3gf5-cxq9-w223/GHSA-3gf5-cxq9-w223.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode\"},{\"advisory\":\"https://github.com/advisories/GHSA-6933-jpx5-q87q\",\"aliases\":[\"CVE-2025-71336\"],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/09/GHSA-6933-jpx5-q87q/GHSA-6933-jpx5-q87q.json\",\"id\":\"GHSA-6933-jpx5-q87q\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2025/09/GHSA-6933-jpx5-q87q/GHSA-6933-jpx5-q87q.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Flowise has unsandboxed remote code execution via Custom MCP\"},{\"advisory\":\"https://github.com/advisories/GHSA-q67q-549q-p849\",\"aliases\":[\"CVE-2025-71334\"],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/09/GHSA-q67q-549q-p849/GHSA-q67q-549q-p849.json\",\"id\":\"GHSA-q67q-549q-p849\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2025/09/GHSA-q67q-549q-p849/GHSA-q67q-549q-p849.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Flowise has arbitrary file access due to missing chat flow id validation\"},{\"advisory\":\"https://github.com/advisories/GHSA-273h-m46v-96q4\",\"aliases\":[\"CVE-2026-56367\"],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/02/GHSA-273h-m46v-96q4/GHSA-273h-m46v-96q4.json\",\"id\":\"GHSA-273h-m46v-96q4\",\"packages\":[\"Magick.NET-Q16-AnyCPU\",\"Magick.NET-Q16-HDRI-AnyCPU\",\"Magick.NET-Q16-HDRI-OpenMP-arm64\",\"Magick.NET-Q16-HDRI-OpenMP-x64\",\"Magick.NET-Q16-HDRI-arm64\",\"Magick.NET-Q16-HDRI-x64\",\"Magick.NET-Q16-HDRI-x86\",\"Magick.NET-Q16-OpenMP-arm64\",\"Magick.NET-Q16-OpenMP-x64\",\"Magick.NET-Q16-OpenMP-x86\",\"Magick.NET-Q16-arm64\",\"Magick.NET-Q16-x64\",\"Magick.NET-Q16-x86\",\"Magick.NET-Q8-AnyCPU\",\"Magick.NET-Q8-OpenMP-arm64\",\"Magick.NET-Q8-OpenMP-x64\",\"Magick.NET-Q8-arm64\",\"Magick.NET-Q8-x64\",\"Magick.NET-Q8-x86\"],\"path\":\"advisories/github-reviewed/2026/02/GHSA-273h-m46v-96q4/GHSA-273h-m46v-96q4.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds\"},{\"advisory\":\"https://github.com/advisories/GHSA-c3hj-m5hq-59xw\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-c3hj-m5hq-59xw/GHSA-c3hj-m5hq-59xw.json\",\"id\":\"GHSA-c3hj-m5hq-59xw\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-c3hj-m5hq-59xw/GHSA-c3hj-m5hq-59xw.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Duplicate Advisory : Flowise allows arbitrary file write to RCE\"},{\"advisory\":\"https://github.com/advisories/GHSA-mq7r-vm99-p7vx\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-mq7r-vm99-p7vx/GHSA-mq7r-vm99-p7vx.json\",\"id\":\"GHSA-mq7r-vm99-p7vx\",\"packages\":[\"picklescan\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-mq7r-vm99-p7vx/GHSA-mq7r-vm99-p7vx.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode\"},{\"advisory\":\"https://github.com/advisories/GHSA-q2xp-j85q-883h\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-q2xp-j85q-883h/GHSA-q2xp-j85q-883h.json\",\"id\":\"GHSA-q2xp-j85q-883h\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-q2xp-j85q-883h/GHSA-q2xp-j85q-883h.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP\"},{\"advisory\":\"https://github.com/advisories/GHSA-rg39-4fm5-hrp2\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-rg39-4fm5-hrp2/GHSA-rg39-4fm5-hrp2.json\",\"id\":\"GHSA-rg39-4fm5-hrp2\",\"packages\":[\"Magick.NET-Q8-x86\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-rg39-4fm5-hrp2/GHSA-rg39-4fm5-hrp2.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds\"},{\"advisory\":\"https://github.com/advisories/GHSA-w5r9-j49j-2m55\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-w5r9-j49j-2m55/GHSA-w5r9-j49j-2m55.json\",\"id\":\"GHSA-w5r9-j49j-2m55\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-w5r9-j49j-2m55/GHSA-w5r9-j49j-2m55.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Duplicate Advisory : Flowise has arbitrary file access due to missing chat flow id validation\"},{\"advisory\":\"https://github.com/advisories/GHSA-q2hg-643c-gw8h\",\"aliases\":[\"CVE-2025-54550\"],\"commit\":\"https://github.com/github/advisory-database/commit/bfee4fa8fd91e14b833b776680f2381a9311a967\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/bfee4fa8fd91e14b833b776680f2381a9311a967/advisories/github-reviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json\",\"id\":\"GHSA-q2hg-643c-gw8h\",\"packages\":[\"apache-airflow\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json\",\"severity\":\"HIGH\",\"status\":\"withdrawn\",\"summary\":\"Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag\"},{\"advisory\":\"https://github.com/advisories/GHSA-x9rp-7wh3-2rj5\",\"aliases\":[\"CVE-2026-44265\"],\"commit\":\"https://github.com/github/advisory-database/commit/3166063e03a19d7eaa16d650902b995c4946ccac\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3166063e03a19d7eaa16d650902b995c4946ccac/advisories/github-reviewed/2026/11/GHSA-x9rp-7wh3-2rj5/GHSA-x9rp-7wh3-2rj5.json\",\"id\":\"GHSA-x9rp-7wh3-2rj5\",\"packages\":[\"@enspirit/elo\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-x9rp-7wh3-2rj5/GHSA-x9rp-7wh3-2rj5.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Elo backends have code injection via unvalidated emission of programmatic AST fields\"},{\"advisory\":\"https://github.com/advisories/GHSA-33r5-xmm8-v6x5\",\"aliases\":[\"CVE-2026-44267\"],\"commit\":\"https://github.com/github/advisory-database/commit/7afed176f45c534bccb2f43fa4272d08dafd4efb\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/7afed176f45c534bccb2f43fa4272d08dafd4efb/advisories/github-reviewed/2026/11/GHSA-33r5-xmm8-v6x5/GHSA-33r5-xmm8-v6x5.json\",\"id\":\"GHSA-33r5-xmm8-v6x5\",\"packages\":[\"@enspirit/elo\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-33r5-xmm8-v6x5/GHSA-33r5-xmm8-v6x5.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access\"},{\"advisory\":\"https://github.com/advisories/GHSA-7w38-ggh5-v542\",\"aliases\":[\"CVE-2026-44266\"],\"commit\":\"https://github.com/github/advisory-database/commit/7afed176f45c534bccb2f43fa4272d08dafd4efb\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/7afed176f45c534bccb2f43fa4272d08dafd4efb/advisories/github-reviewed/2026/11/GHSA-7w38-ggh5-v542/GHSA-7w38-ggh5-v542.json\",\"id\":\"GHSA-7w38-ggh5-v542\",\"packages\":[\"@enspirit/elo\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-7w38-ggh5-v542/GHSA-7w38-ggh5-v542.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels\"},{\"advisory\":\"https://github.com/advisories/GHSA-m9cv-24rx-8mv7\",\"aliases\":[\"CVE-2026-55409\"],\"commit\":\"https://github.com/github/advisory-database/commit/bfb1ff7326519dc6a6f4a1ac745d1b011e5b17e4\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/bfb1ff7326519dc6a6f4a1ac745d1b011e5b17e4/advisories/github-reviewed/2026/06/GHSA-m9cv-24rx-8mv7/GHSA-m9cv-24rx-8mv7.json\",\"id\":\"GHSA-m9cv-24rx-8mv7\",\"packages\":[\"filament/forms\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-m9cv-24rx-8mv7/GHSA-m9cv-24rx-8mv7.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Filament: Disabled RichEditor field state can be used for XSS\"},{\"advisory\":\"https://github.com/advisories/GHSA-q6r4-3wmg-fwcq\",\"aliases\":[\"CVE-2026-55686\"],\"commit\":\"https://github.com/github/advisory-database/commit/c85a0fbb78e2cf8aa52f64a30136b1361c9751a1\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/c85a0fbb78e2cf8aa52f64a30136b1361c9751a1/advisories/github-reviewed/2026/06/GHSA-q6r4-3wmg-fwcq/GHSA-q6r4-3wmg-fwcq.json\",\"id\":\"GHSA-q6r4-3wmg-fwcq\",\"packages\":[\"github.com/containers/podman/v5\",\"github.com/containers/podman/v4\",\"github.com/containers/podman/v3\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-q6r4-3wmg-fwcq/GHSA-q6r4-3wmg-fwcq.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Podman: WORKDIR symlink traversal vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-9c4c-g95m-c8cp\",\"aliases\":[\"CVE-2025-71332\"],\"commit\":\"https://github.com/github/advisory-database/commit/2d4bd9ec59f215311b7e656b111083fc252ac893\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/2d4bd9ec59f215311b7e656b111083fc252ac893/advisories/github-reviewed/2025/04/GHSA-9c4c-g95m-c8cp/GHSA-9c4c-g95m-c8cp.json\",\"id\":\"GHSA-9c4c-g95m-c8cp\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2025/04/GHSA-9c4c-g95m-c8cp/GHSA-9c4c-g95m-c8cp.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"FlowiseDB vulnerable to SQL Injection by authenticated users\"},{\"advisory\":\"https://github.com/advisories/GHSA-29hf-rm4x-xxph\",\"aliases\":[\"CVE-2026-55448\"],\"commit\":\"https://github.com/github/advisory-database/commit/b91a7d18bf660e4df3d16ce86ea8a4c5683e1a74\",\"ecosystems\":[\"crates.io\"],\"file\":\"https://github.com/github/advisory-database/blob/b91a7d18bf660e4df3d16ce86ea8a4c5683e1a74/advisories/github-reviewed/2026/06/GHSA-29hf-rm4x-xxph/GHSA-29hf-rm4x-xxph.json\",\"id\":\"GHSA-29hf-rm4x-xxph\",\"packages\":[\"mise\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-29hf-rm4x-xxph/GHSA-29hf-rm4x-xxph.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Mise's local credential_command executes untrusted config\"},{\"advisory\":\"https://github.com/advisories/GHSA-gh9r-c94j-cmp5\",\"aliases\":[\"CVE-2026-115878\"],\"commit\":\"https://github.com/github/advisory-database/commit/17f6aad969d6fbf66d428725d56c65072693f130\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/17f6aad969d6fbf66d428725d56c65072693f130/advisories/github-reviewed/2026/11/GHSA-gh9r-c94j-cmp5/GHSA-gh9r-c94j-cmp5.json\",\"id\":\"GHSA-gh9r-c94j-cmp5\",\"packages\":[\"stanza\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-gh9r-c94j-cmp5/GHSA-gh9r-c94j-cmp5.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Stanza: RCE via pickle deserialization in the lemmatizer\"}],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 3, 2026, GitHub's security advisory list published 22 new advisories, changed 29, and withdrew 1. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "https://flarereef.flareforward.com/files/watch/59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc.json", "txHash": "0x465af45fc372ae49f58b88dd2f00e90b86e9d71b08ff5fbb446099f6000eb27c", "receiptUrl": "https://flare-explorer.flare.network/tx/0x465af45fc372ae49f58b88dd2f00e90b86e9d71b08ff5fbb446099f6000eb27c", "blockNumber": 73691892, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": [], "parsed": {"counts": {"changed": 29, "published": 22, "removed": 0, "withdrawn": 1}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-03", "kind": "watch-day", "recordedAt": "2026-11-04T02:17:13Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-wp3j-xq48-xpjw", "aliases": ["CVE-2025-9566"], "commit": "https://github.com/github/advisory-database/commit/887dcb68f13a7d9be8bf3d604c2e32fc3d6960e8", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/887dcb68f13a7d9be8bf3d604c2e32fc3d6960e8/advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json", "id": "GHSA-wp3j-xq48-xpjw", "packages": ["github.com/containers/podman/v5", "github.com/containers/podman/v4"], "path": "advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json", "severity": "HIGH", "status": "changed", "summary": "podman kube play symlink traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-v653-r55g-hcmg", "aliases": ["CVE-2025-13327"], "commit": "https://github.com/github/advisory-database/commit/109512409477d1b7dfa372b0346a28a59d47e04d", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/109512409477d1b7dfa372b0346a28a59d47e04d/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "id": "GHSA-v653-r55g-hcmg", "packages": ["uv"], "path": "advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "severity": "MODERATE", "status": "changed", "summary": "uv has ZIP payload obfuscation through parsing differentials"}, {"advisory": "https://github.com/advisories/GHSA-f23m-r3pf-42rh", "aliases": ["CVE-2026-2950"], "commit": "https://github.com/github/advisory-database/commit/0b1941f7d05b03f4ed6469b0236dd3c59357f497", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/0b1941f7d05b03f4ed6469b0236dd3c59357f497/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json", "id": "GHSA-f23m-r3pf-42rh", "packages": ["lodash", "lodash-es", "lodash-amd", "lodash.unset", "lodash.omit"], "path": "advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json", "severity": "MODERATE", "status": "changed", "summary": "lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt"}, {"advisory": "https://github.com/advisories/GHSA-2cvf-wqm6-wr9g", "aliases": ["CVE-2026-94603"], "commit": "https://github.com/github/advisory-database/commit/b9d5dfa2061837f892e2cdbecfe33751bcd902fa", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/b9d5dfa2061837f892e2cdbecfe33751bcd902fa/advisories/github-reviewed/2026/10/GHSA-2cvf-wqm6-wr9g/GHSA-2cvf-wqm6-wr9g.json", "id": "GHSA-2cvf-wqm6-wr9g", "packages": ["github.com/containers/podman/v4", "go.podman.io/podman/v6", "github.com/containers/podman/v5"], "path": "advisories/github-reviewed/2026/10/GHSA-2cvf-wqm6-wr9g/GHSA-2cvf-wqm6-wr9g.json", "severity": "CRITICAL", "status": "changed", "summary": "Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation"}, {"advisory": "https://github.com/advisories/GHSA-23f4-hfmq-94mj", "aliases": ["CVE-2026-24807"], "commit": "https://github.com/github/advisory-database/commit/1cd5f193871f6f187dcd0bb684096313535d13dc", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/1cd5f193871f6f187dcd0bb684096313535d13dc/advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json", "id": "GHSA-23f4-hfmq-94mj", "packages": ["com.github.liuyueyi.media:batik-codec-fix"], "path": "advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json", "severity": "MODERATE", "status": "changed", "summary": "Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec"}, {"advisory": "https://github.com/advisories/GHSA-4c5c-2vc3-x5w2", "aliases": ["CVE-2024-27928"], "commit": "https://github.com/github/advisory-database/commit/09a0c50f4c060b454b1beba39b06607b692ae442", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/09a0c50f4c060b454b1beba39b06607b692ae442/advisories/github-reviewed/2026/06/GHSA-4c5c-2vc3-x5w2/GHSA-4c5c-2vc3-x5w2.json", "id": "GHSA-4c5c-2vc3-x5w2", "packages": ["vantage6"], "path": "advisories/github-reviewed/2026/06/GHSA-4c5c-2vc3-x5w2/GHSA-4c5c-2vc3-x5w2.json", "severity": "MODERATE", "status": "changed", "summary": "Vantage6: 2FA can be circumvented with hacked email access"}, {"advisory": "https://github.com/advisories/GHSA-5549-c5q7-fj65", "aliases": ["CVE-2024-24769"], "commit": "https://github.com/github/advisory-database/commit/3ad38b79a298df87ea7277ef69a97bdf8ac19070", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3ad38b79a298df87ea7277ef69a97bdf8ac19070/advisories/github-reviewed/2026/06/GHSA-5549-c5q7-fj65/GHSA-5549-c5q7-fj65.json", "id": "GHSA-5549-c5q7-fj65", "packages": ["vantage6"], "path": "advisories/github-reviewed/2026/06/GHSA-5549-c5q7-fj65/GHSA-5549-c5q7-fj65.json", "severity": "LOW", "status": "changed", "summary": "Vantage6: No limit on emails sent for password/MFA reset"}, {"advisory": "https://github.com/advisories/GHSA-gg2p-37pv-v7fq", "aliases": ["CVE-2026-18948"], "commit": "https://github.com/github/advisory-database/commit/2f5c9c3dc515527cf27c5dea15ea0c286b09a6a1", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/2f5c9c3dc515527cf27c5dea15ea0c286b09a6a1/advisories/github-reviewed/2026/08/GHSA-gg2p-37pv-v7fq/GHSA-gg2p-37pv-v7fq.json", "id": "GHSA-gg2p-37pv-v7fq", "packages": ["feast"], "path": "advisories/github-reviewed/2026/08/GHSA-gg2p-37pv-v7fq/GHSA-gg2p-37pv-v7fq.json", "severity": "CRITICAL", "status": "changed", "summary": "Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs"}, {"advisory": "https://github.com/advisories/GHSA-263q-5cv3-xq9g", "aliases": ["CVE-2025-68939"], "commit": "https://github.com/github/advisory-database/commit/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3/advisories/github-reviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json", "id": "GHSA-263q-5cv3-xq9g", "packages": ["code.gitea.io/gitea"], "path": "advisories/github-reviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json", "severity": "HIGH", "status": "changed", "summary": "Gitea allows attackers to add attachments with forbidden file extensions"}, {"advisory": "https://github.com/advisories/GHSA-2fqr-mr3j-6wp8", "aliases": ["CVE-2026-54279"], "commit": "https://github.com/github/advisory-database/commit/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3/advisories/github-reviewed/2026/06/GHSA-2fqr-mr3j-6wp8/GHSA-2fqr-mr3j-6wp8.json", "id": "GHSA-2fqr-mr3j-6wp8", "packages": ["aiohttp"], "path": "advisories/github-reviewed/2026/06/GHSA-2fqr-mr3j-6wp8/GHSA-2fqr-mr3j-6wp8.json", "severity": "LOW", "status": "changed", "summary": "aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence"}, {"advisory": "https://github.com/advisories/GHSA-m3qr-fvp4-78xj", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/20d31bd4c8caa6b82129e0d004e578e5cebe8f91", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/20d31bd4c8caa6b82129e0d004e578e5cebe8f91/advisories/github-reviewed/2026/11/GHSA-m3qr-fvp4-78xj/GHSA-m3qr-fvp4-78xj.json", "id": "GHSA-m3qr-fvp4-78xj", "packages": ["github.com/basekick-labs/arc"], "path": "advisories/github-reviewed/2026/11/GHSA-m3qr-fvp4-78xj/GHSA-m3qr-fvp4-78xj.json", "severity": "LOW", "status": "published", "summary": "Arc has unauthenticated application log disclosure via `/api/v1/logs`"}, {"advisory": "https://github.com/advisories/GHSA-h26j-4vp7-x9w2", "aliases": ["CVE-2026-62848"], "commit": "https://github.com/github/advisory-database/commit/5742631ca9236a1b99fb823b7dc5746894dc9c97", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/5742631ca9236a1b99fb823b7dc5746894dc9c97/advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json", "id": "GHSA-h26j-4vp7-x9w2", "packages": ["Metalama.Framework"], "path": "advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json", "severity": "HIGH", "status": "published", "summary": "Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution"}, {"advisory": "https://github.com/advisories/GHSA-9ppr-wfw9-xvr2", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/2c0fc1b40f792460bac314a3589ee722fddf9ab7", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2c0fc1b40f792460bac314a3589ee722fddf9ab7/advisories/github-reviewed/2026/11/GHSA-9ppr-wfw9-xvr2/GHSA-9ppr-wfw9-xvr2.json", "id": "GHSA-9ppr-wfw9-xvr2", "packages": ["github.com/tinfoil-factory/netfoil"], "path": "advisories/github-reviewed/2026/11/GHSA-9ppr-wfw9-xvr2/GHSA-9ppr-wfw9-xvr2.json", "severity": "MODERATE", "status": "published", "summary": "Netfoil doesn't decrement TTL"}, {"advisory": "https://github.com/advisories/GHSA-g27p-qf6j-c96c", "aliases": ["CVE-2026-102870"], "commit": "https://github.com/github/advisory-database/commit/0713d11c551f4fb074272b59e61c545ca28b395e", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/0713d11c551f4fb074272b59e61c545ca28b395e/advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "id": "GHSA-g27p-qf6j-c96c", "packages": ["Microsoft.AspNetCore.Components.WebAssembly.Server"], "path": "advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-4mpw-cpwj-hxxj", "aliases": ["CVE-2026-70197"], "commit": "https://github.com/github/advisory-database/commit/1b2b2b1ca2543a77a29a869f05f5d5ab9a48832d", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/1b2b2b1ca2543a77a29a869f05f5d5ab9a48832d/advisories/github-reviewed/2026/10/GHSA-4mpw-cpwj-hxxj/GHSA-4mpw-cpwj-hxxj.json", "id": "GHSA-4mpw-cpwj-hxxj", "packages": ["Microsoft.NETCore.App.Runtime.win-arm64", "Microsoft.NETCore.App.Runtime.win-x64", "Microsoft.NETCore.App.Runtime.win-x86"], "path": "advisories/github-reviewed/2026/10/GHSA-4mpw-cpwj-hxxj/GHSA-4mpw-cpwj-hxxj.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "aliases": ["CVE-2026-111497"], "commit": "https://github.com/github/advisory-database/commit/a8429404393e1324233442f9b6b686fa23906d49", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/a8429404393e1324233442f9b6b686fa23906d49/advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json", "id": "GHSA-9v8h-qqgm-4m35", "packages": ["brotli", "brotlicffi"], "path": "advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json", "severity": "CRITICAL", "status": "changed", "summary": "Brotli: Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package"}, {"advisory": "https://github.com/advisories/GHSA-g27p-qf6j-c96c", "aliases": ["CVE-2026-102870"], "commit": "https://github.com/github/advisory-database/commit/a8429404393e1324233442f9b6b686fa23906d49", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/a8429404393e1324233442f9b6b686fa23906d49/advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "id": "GHSA-g27p-qf6j-c96c", "packages": ["Microsoft.AspNetCore.Components.WebAssembly.Server"], "path": "advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-gqj5-2xp5-3qmp", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/6b4ca00b2205554fe416e66ca4f6bbaa419faff0", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/6b4ca00b2205554fe416e66ca4f6bbaa419faff0/advisories/github-reviewed/2026/06/GHSA-gqj5-2xp5-3qmp/GHSA-gqj5-2xp5-3qmp.json", "id": "GHSA-gqj5-2xp5-3qmp", "packages": ["org.keycloak:keycloak-services"], "path": "advisories/github-reviewed/2026/06/GHSA-gqj5-2xp5-3qmp/GHSA-gqj5-2xp5-3qmp.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Authentication bypass via jwt algorithm confusion"}, {"advisory": "https://github.com/advisories/GHSA-48v2-6jcm-fc99", "aliases": ["CVE-2026-62331"], "commit": "https://github.com/github/advisory-database/commit/2b369933cd4a9c17398ae7d4532f48e2ac48c173", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2b369933cd4a9c17398ae7d4532f48e2ac48c173/advisories/github-reviewed/2026/11/GHSA-48v2-6jcm-fc99/GHSA-48v2-6jcm-fc99.json", "id": "GHSA-48v2-6jcm-fc99", "packages": ["github.com/mtzanidakis/praktor"], "path": "advisories/github-reviewed/2026/11/GHSA-48v2-6jcm-fc99/GHSA-48v2-6jcm-fc99.json", "severity": "HIGH", "status": "published", "summary": "praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)"}, {"advisory": "https://github.com/advisories/GHSA-j97h-3f8r-mrjr", "aliases": ["CVE-2026-11800"], "commit": "https://github.com/github/advisory-database/commit/2b369933cd4a9c17398ae7d4532f48e2ac48c173", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/2b369933cd4a9c17398ae7d4532f48e2ac48c173/advisories/github-reviewed/2026/11/GHSA-j97h-3f8r-mrjr/GHSA-j97h-3f8r-mrjr.json", "id": "GHSA-j97h-3f8r-mrjr", "packages": ["org.keycloak:keycloak-services"], "path": "advisories/github-reviewed/2026/11/GHSA-j97h-3f8r-mrjr/GHSA-j97h-3f8r-mrjr.json", "severity": "HIGH", "status": "published", "summary": "Keycloak has authentication bypass via jwt algorithm confusion"}, {"advisory": "https://github.com/advisories/GHSA-p3jp-9v83-76w9", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/772fd8ac4b2e4d12a16d65630979ba79c9a7e82f", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/772fd8ac4b2e4d12a16d65630979ba79c9a7e82f/advisories/github-reviewed/2026/11/GHSA-p3jp-9v83-76w9/GHSA-p3jp-9v83-76w9.json", "id": "GHSA-p3jp-9v83-76w9", "packages": ["Microsoft.DotNet.ILCompiler", "Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64", "Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64", "Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64", "Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64", "Microsoft.NETCore.App.Runtime.Mono.android-arm", "Microsoft.NETCore.App.Runtime.Mono.android-arm64", "Microsoft.NETCore.App.Runtime.Mono.android-x64", "Microsoft.NETCore.App.Runtime.Mono.android-x86", "Microsoft.NETCore.App.Runtime.Mono.browser-wasm", "Microsoft.NETCore.App.Runtime.Mono.ios-arm64", "Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64", "Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64", "Microsoft.NETCore.App.Runtime.Mono.linux-arm", "Microsoft.NETCore.App.Runtime.Mono.linux-arm64", "Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64", "Microsoft.NETCore.App.Runtime.Mono.linux-x64", "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64", "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64", "Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm", "Microsoft.NETCore.App.Runtime.Mono.osx-arm64", "Microsoft.NETCore.App.Runtime.Mono.osx-x64", "Microsoft.NETCore.App.Runtime.Mono.tvos-arm64", "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64", "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64", "Microsoft.NETCore.App.Runtime.Mono.wasi-wasm", "Microsoft.NETCore.App.Runtime.Mono.win-x64", "Microsoft.NETCore.App.Runtime.Mono.win-x86", "Microsoft.NETCore.App.Runtime.linux-arm", "Microsoft.NETCore.App.Runtime.linux-arm64", "Microsoft.NETCore.App.Runtime.linux-bionic-arm64", "Microsoft.NETCore.App.Runtime.linux-bionic-x64", "Microsoft.NETCore.App.Runtime.linux-musl-arm", "Microsoft.NETCore.App.Runtime.linux-musl-arm64", "Microsoft.NETCore.App.Runtime.linux-musl-x64", "Microsoft.NETCore.App.Runtime.linux-x64", "Microsoft.NETCore.App.Runtime.osx-arm64", "Microsoft.NETCore.App.Runtime.osx-x64", "Microsoft.NETCore.App.Runtime.win-arm64", "Microsoft.NETCore.App.Runtime.win-x64", "Microsoft.NETCore.App.Runtime.win-x86", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.win-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.win-x86", "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.android-x64", "Microsoft.NETCore.App.Runtime.android-arm64", "Microsoft.NETCore.App.Runtime.android-x64", "Microsoft.NETCore.App.Runtime.android-arm", "Microsoft.NETCore.App.Runtime.browser-wasm", "Microsoft.NETCore.App.Runtime.ios-arm64", "Microsoft.NETCore.App.Runtime.iossimulator-arm64", "Microsoft.NETCore.App.Runtime.iossimulator-x64", "Microsoft.NETCore.App.Runtime.maccatalyst-arm64", "Microsoft.NETCore.App.Runtime.maccatalyst-x64", "Microsoft.NETCore.App.Runtime.tvos-arm64", "Microsoft.NETCore.App.Runtime.tvossimulator-arm64", "Microsoft.NETCore.App.Runtime.tvossimulator-x64"], "path": "advisories/github-reviewed/2026/11/GHSA-p3jp-9v83-76w9/GHSA-p3jp-9v83-76w9.json", "severity": "HIGH", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-8vvx-qvq9-5948", "aliases": ["CVE-2025-71338"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/03/GHSA-8vvx-qvq9-5948/GHSA-8vvx-qvq9-5948.json", "id": "GHSA-8vvx-qvq9-5948", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/03/GHSA-8vvx-qvq9-5948/GHSA-8vvx-qvq9-5948.json", "severity": "CRITICAL", "status": "changed", "summary": "Flowise allows arbitrary file write to RCE"}, {"advisory": "https://github.com/advisories/GHSA-3gf5-cxq9-w223", "aliases": ["CVE-2025-71340"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/08/GHSA-3gf5-cxq9-w223/GHSA-3gf5-cxq9-w223.json", "id": "GHSA-3gf5-cxq9-w223", "packages": ["picklescan"], "path": "advisories/github-reviewed/2025/08/GHSA-3gf5-cxq9-w223/GHSA-3gf5-cxq9-w223.json", "severity": "HIGH", "status": "changed", "summary": "Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode"}, {"advisory": "https://github.com/advisories/GHSA-6933-jpx5-q87q", "aliases": ["CVE-2025-71336"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/09/GHSA-6933-jpx5-q87q/GHSA-6933-jpx5-q87q.json", "id": "GHSA-6933-jpx5-q87q", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/09/GHSA-6933-jpx5-q87q/GHSA-6933-jpx5-q87q.json", "severity": "CRITICAL", "status": "changed", "summary": "Flowise has unsandboxed remote code execution via Custom MCP"}, {"advisory": "https://github.com/advisories/GHSA-q67q-549q-p849", "aliases": ["CVE-2025-71334"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/09/GHSA-q67q-549q-p849/GHSA-q67q-549q-p849.json", "id": "GHSA-q67q-549q-p849", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/09/GHSA-q67q-549q-p849/GHSA-q67q-549q-p849.json", "severity": "CRITICAL", "status": "changed", "summary": "Flowise has arbitrary file access due to missing chat flow id validation"}, {"advisory": "https://github.com/advisories/GHSA-273h-m46v-96q4", "aliases": ["CVE-2026-56367"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/02/GHSA-273h-m46v-96q4/GHSA-273h-m46v-96q4.json", "id": "GHSA-273h-m46v-96q4", "packages": ["Magick.NET-Q16-AnyCPU", "Magick.NET-Q16-HDRI-AnyCPU", "Magick.NET-Q16-HDRI-OpenMP-arm64", "Magick.NET-Q16-HDRI-OpenMP-x64", "Magick.NET-Q16-HDRI-arm64", "Magick.NET-Q16-HDRI-x64", "Magick.NET-Q16-HDRI-x86", "Magick.NET-Q16-OpenMP-arm64", "Magick.NET-Q16-OpenMP-x64", "Magick.NET-Q16-OpenMP-x86", "Magick.NET-Q16-arm64", "Magick.NET-Q16-x64", "Magick.NET-Q16-x86", "Magick.NET-Q8-AnyCPU", "Magick.NET-Q8-OpenMP-arm64", "Magick.NET-Q8-OpenMP-x64", "Magick.NET-Q8-arm64", "Magick.NET-Q8-x64", "Magick.NET-Q8-x86"], "path": "advisories/github-reviewed/2026/02/GHSA-273h-m46v-96q4/GHSA-273h-m46v-96q4.json", "severity": "LOW", "status": "changed", "summary": "ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds"}, {"advisory": "https://github.com/advisories/GHSA-c3hj-m5hq-59xw", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-c3hj-m5hq-59xw/GHSA-c3hj-m5hq-59xw.json", "id": "GHSA-c3hj-m5hq-59xw", "packages": ["flowise"], "path": "advisories/github-reviewed/2026/06/GHSA-c3hj-m5hq-59xw/GHSA-c3hj-m5hq-59xw.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory : Flowise allows arbitrary file write to RCE"}, {"advisory": "https://github.com/advisories/GHSA-mq7r-vm99-p7vx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-mq7r-vm99-p7vx/GHSA-mq7r-vm99-p7vx.json", "id": "GHSA-mq7r-vm99-p7vx", "packages": ["picklescan"], "path": "advisories/github-reviewed/2026/06/GHSA-mq7r-vm99-p7vx/GHSA-mq7r-vm99-p7vx.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode"}, {"advisory": "https://github.com/advisories/GHSA-q2xp-j85q-883h", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-q2xp-j85q-883h/GHSA-q2xp-j85q-883h.json", "id": "GHSA-q2xp-j85q-883h", "packages": ["flowise"], "path": "advisories/github-reviewed/2026/06/GHSA-q2xp-j85q-883h/GHSA-q2xp-j85q-883h.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP"}, {"advisory": "https://github.com/advisories/GHSA-rg39-4fm5-hrp2", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-rg39-4fm5-hrp2/GHSA-rg39-4fm5-hrp2.json", "id": "GHSA-rg39-4fm5-hrp2", "packages": ["Magick.NET-Q8-x86"], "path": "advisories/github-reviewed/2026/06/GHSA-rg39-4fm5-hrp2/GHSA-rg39-4fm5-hrp2.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds"}, {"advisory": "https://github.com/advisories/GHSA-w5r9-j49j-2m55", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-w5r9-j49j-2m55/GHSA-w5r9-j49j-2m55.json", "id": "GHSA-w5r9-j49j-2m55", "packages": ["flowise"], "path": "advisories/github-reviewed/2026/06/GHSA-w5r9-j49j-2m55/GHSA-w5r9-j49j-2m55.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory : Flowise has arbitrary file access due to missing chat flow id validation"}, {"advisory": "https://github.com/advisories/GHSA-q2hg-643c-gw8h", "aliases": ["CVE-2025-54550"], "commit": "https://github.com/github/advisory-database/commit/bfee4fa8fd91e14b833b776680f2381a9311a967", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/bfee4fa8fd91e14b833b776680f2381a9311a967/advisories/github-reviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json", "id": "GHSA-q2hg-643c-gw8h", "packages": ["apache-airflow"], "path": "advisories/github-reviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json", "severity": "HIGH", "status": "withdrawn", "summary": "Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag"}, {"advisory": "https://github.com/advisories/GHSA-x9rp-7wh3-2rj5", "aliases": ["CVE-2026-44265"], "commit": "https://github.com/github/advisory-database/commit/3166063e03a19d7eaa16d650902b995c4946ccac", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3166063e03a19d7eaa16d650902b995c4946ccac/advisories/github-reviewed/2026/11/GHSA-x9rp-7wh3-2rj5/GHSA-x9rp-7wh3-2rj5.json", "id": "GHSA-x9rp-7wh3-2rj5", "packages": ["@enspirit/elo"], "path": "advisories/github-reviewed/2026/11/GHSA-x9rp-7wh3-2rj5/GHSA-x9rp-7wh3-2rj5.json", "severity": "HIGH", "status": "published", "summary": "Elo backends have code injection via unvalidated emission of programmatic AST fields"}, {"advisory": "https://github.com/advisories/GHSA-33r5-xmm8-v6x5", "aliases": ["CVE-2026-44267"], "commit": "https://github.com/github/advisory-database/commit/7afed176f45c534bccb2f43fa4272d08dafd4efb", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7afed176f45c534bccb2f43fa4272d08dafd4efb/advisories/github-reviewed/2026/11/GHSA-33r5-xmm8-v6x5/GHSA-33r5-xmm8-v6x5.json", "id": "GHSA-33r5-xmm8-v6x5", "packages": ["@enspirit/elo"], "path": "advisories/github-reviewed/2026/11/GHSA-33r5-xmm8-v6x5/GHSA-33r5-xmm8-v6x5.json", "severity": "CRITICAL", "status": "published", "summary": "Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access"}, {"advisory": "https://github.com/advisories/GHSA-7w38-ggh5-v542", "aliases": ["CVE-2026-44266"], "commit": "https://github.com/github/advisory-database/commit/7afed176f45c534bccb2f43fa4272d08dafd4efb", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7afed176f45c534bccb2f43fa4272d08dafd4efb/advisories/github-reviewed/2026/11/GHSA-7w38-ggh5-v542/GHSA-7w38-ggh5-v542.json", "id": "GHSA-7w38-ggh5-v542", "packages": ["@enspirit/elo"], "path": "advisories/github-reviewed/2026/11/GHSA-7w38-ggh5-v542/GHSA-7w38-ggh5-v542.json", "severity": "CRITICAL", "status": "published", "summary": "Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels"}, {"advisory": "https://github.com/advisories/GHSA-m9cv-24rx-8mv7", "aliases": ["CVE-2026-55409"], "commit": "https://github.com/github/advisory-database/commit/bfb1ff7326519dc6a6f4a1ac745d1b011e5b17e4", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/bfb1ff7326519dc6a6f4a1ac745d1b011e5b17e4/advisories/github-reviewed/2026/06/GHSA-m9cv-24rx-8mv7/GHSA-m9cv-24rx-8mv7.json", "id": "GHSA-m9cv-24rx-8mv7", "packages": ["filament/forms"], "path": "advisories/github-reviewed/2026/06/GHSA-m9cv-24rx-8mv7/GHSA-m9cv-24rx-8mv7.json", "severity": "HIGH", "status": "changed", "summary": "Filament: Disabled RichEditor field state can be used for XSS"}, {"advisory": "https://github.com/advisories/GHSA-q6r4-3wmg-fwcq", "aliases": ["CVE-2026-55686"], "commit": "https://github.com/github/advisory-database/commit/c85a0fbb78e2cf8aa52f64a30136b1361c9751a1", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c85a0fbb78e2cf8aa52f64a30136b1361c9751a1/advisories/github-reviewed/2026/06/GHSA-q6r4-3wmg-fwcq/GHSA-q6r4-3wmg-fwcq.json", "id": "GHSA-q6r4-3wmg-fwcq", "packages": ["github.com/containers/podman/v5", "github.com/containers/podman/v4", "github.com/containers/podman/v3"], "path": "advisories/github-reviewed/2026/06/GHSA-q6r4-3wmg-fwcq/GHSA-q6r4-3wmg-fwcq.json", "severity": "MODERATE", "status": "changed", "summary": "Podman: WORKDIR symlink traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-9c4c-g95m-c8cp", "aliases": ["CVE-2025-71332"], "commit": "https://github.com/github/advisory-database/commit/2d4bd9ec59f215311b7e656b111083fc252ac893", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/2d4bd9ec59f215311b7e656b111083fc252ac893/advisories/github-reviewed/2025/04/GHSA-9c4c-g95m-c8cp/GHSA-9c4c-g95m-c8cp.json", "id": "GHSA-9c4c-g95m-c8cp", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/04/GHSA-9c4c-g95m-c8cp/GHSA-9c4c-g95m-c8cp.json", "severity": "HIGH", "status": "changed", "summary": "FlowiseDB vulnerable to SQL Injection by authenticated users"}, {"advisory": "https://github.com/advisories/GHSA-29hf-rm4x-xxph", "aliases": ["CVE-2026-55448"], "commit": "https://github.com/github/advisory-database/commit/b91a7d18bf660e4df3d16ce86ea8a4c5683e1a74", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/b91a7d18bf660e4df3d16ce86ea8a4c5683e1a74/advisories/github-reviewed/2026/06/GHSA-29hf-rm4x-xxph/GHSA-29hf-rm4x-xxph.json", "id": "GHSA-29hf-rm4x-xxph", "packages": ["mise"], "path": "advisories/github-reviewed/2026/06/GHSA-29hf-rm4x-xxph/GHSA-29hf-rm4x-xxph.json", "severity": "MODERATE", "status": "changed", "summary": "Mise's local credential_command executes untrusted config"}, {"advisory": "https://github.com/advisories/GHSA-gh9r-c94j-cmp5", "aliases": ["CVE-2026-115878"], "commit": "https://github.com/github/advisory-database/commit/17f6aad969d6fbf66d428725d56c65072693f130", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/17f6aad969d6fbf66d428725d56c65072693f130/advisories/github-reviewed/2026/11/GHSA-gh9r-c94j-cmp5/GHSA-gh9r-c94j-cmp5.json", "id": "GHSA-gh9r-c94j-cmp5", "packages": ["stanza"], "path": "advisories/github-reviewed/2026/11/GHSA-gh9r-c94j-cmp5/GHSA-gh9r-c94j-cmp5.json", "severity": "HIGH", "status": "published", "summary": "Stanza: RCE via pickle deserialization in the lemmatizer"}, {"advisory": "https://github.com/advisories/GHSA-68wq-phq7-p2vg", "aliases": ["CVE-2026-55186"], "commit": "https://github.com/github/advisory-database/commit/e283ff073919b1843af36729a333698cb9816520", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/e283ff073919b1843af36729a333698cb9816520/advisories/github-reviewed/2026/10/GHSA-68wq-phq7-p2vg/GHSA-68wq-phq7-p2vg.json", "id": "GHSA-68wq-phq7-p2vg", "packages": ["silverstripe/mfa"], "path": "advisories/github-reviewed/2026/10/GHSA-68wq-phq7-p2vg/GHSA-68wq-phq7-p2vg.json", "severity": "MODERATE", "status": "changed", "summary": "MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow"}, {"advisory": "https://github.com/advisories/GHSA-7pm4-56h2-5rxr", "aliases": ["CVE-2026-5366"], "commit": "https://github.com/github/advisory-database/commit/133ace55605a3f3e9f4331c0643c69660c0efdfa", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/133ace55605a3f3e9f4331c0643c69660c0efdfa/advisories/github-reviewed/2026/06/GHSA-7pm4-56h2-5rxr/GHSA-7pm4-56h2-5rxr.json", "id": "GHSA-7pm4-56h2-5rxr", "packages": ["prefect"], "path": "advisories/github-reviewed/2026/06/GHSA-7pm4-56h2-5rxr/GHSA-7pm4-56h2-5rxr.json", "severity": "CRITICAL", "status": "published", "summary": "Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)"}, {"advisory": "https://github.com/advisories/GHSA-q63x-9pfm-mjx4", "aliases": ["CVE-2026-56121"], "commit": "https://github.com/github/advisory-database/commit/e129255cb37f297a5bc876a9e362d34a443f9d5f", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/e129255cb37f297a5bc876a9e362d34a443f9d5f/advisories/github-reviewed/2026/06/GHSA-q63x-9pfm-mjx4/GHSA-q63x-9pfm-mjx4.json", "id": "GHSA-q63x-9pfm-mjx4", "packages": ["feast"], "path": "advisories/github-reviewed/2026/06/GHSA-q63x-9pfm-mjx4/GHSA-q63x-9pfm-mjx4.json", "severity": "CRITICAL", "status": "changed", "summary": "Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto"}, {"advisory": "https://github.com/advisories/GHSA-qj64-jj84-w38j", "aliases": ["CVE-2026-56091"], "commit": "https://github.com/github/advisory-database/commit/e129255cb37f297a5bc876a9e362d34a443f9d5f", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/e129255cb37f297a5bc876a9e362d34a443f9d5f/advisories/github-reviewed/2026/06/GHSA-qj64-jj84-w38j/GHSA-qj64-jj84-w38j.json", "id": "GHSA-qj64-jj84-w38j", "packages": ["org.apache.shiro:shiro-guice"], "path": "advisories/github-reviewed/2026/06/GHSA-qj64-jj84-w38j/GHSA-qj64-jj84-w38j.json", "severity": "HIGH", "status": "published", "summary": "Apache Shiro shiro-guice module vulnerable to authentication bypass"}, {"advisory": "https://github.com/advisories/GHSA-m8g6-vrr2-x7ff", "aliases": ["CVE-2026-56130"], "commit": "https://github.com/github/advisory-database/commit/acf5bcf01917d2e611bf2966c2e38ee282bc071a", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/acf5bcf01917d2e611bf2966c2e38ee282bc071a/advisories/github-reviewed/2026/06/GHSA-m8g6-vrr2-x7ff/GHSA-m8g6-vrr2-x7ff.json", "id": "GHSA-m8g6-vrr2-x7ff", "packages": ["org.apache.shiro:shiro-core", "org.apache.shiro:shiro-web"], "path": "advisories/github-reviewed/2026/06/GHSA-m8g6-vrr2-x7ff/GHSA-m8g6-vrr2-x7ff.json", "severity": "LOW", "status": "published", "summary": "Apache Shiro's \"remember me\" cookie age is not verified on the server."}, {"advisory": "https://github.com/advisories/GHSA-p2gc-fm5w-94jj", "aliases": ["CVE-2026-66274"], "commit": "https://github.com/github/advisory-database/commit/c84527072ba4f605ae401866e29fb9d00bda7017", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/c84527072ba4f605ae401866e29fb9d00bda7017/advisories/github-reviewed/2026/08/GHSA-p2gc-fm5w-94jj/GHSA-p2gc-fm5w-94jj.json", "id": "GHSA-p2gc-fm5w-94jj", "packages": ["org.apache.qpid:proton-j"], "path": "advisories/github-reviewed/2026/08/GHSA-p2gc-fm5w-94jj/GHSA-p2gc-fm5w-94jj.json", "severity": "HIGH", "status": "changed", "summary": "Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow"}, {"advisory": "https://github.com/advisories/GHSA-57q6-fvp4-pqmm", "aliases": ["CVE-2026-45339"], "commit": "https://github.com/github/advisory-database/commit/54ea6b928d36e4a9a41a26ac072524b191634fd8", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/54ea6b928d36e4a9a41a26ac072524b191634fd8/advisories/github-reviewed/2026/05/GHSA-57q6-fvp4-pqmm/GHSA-57q6-fvp4-pqmm.json", "id": "GHSA-57q6-fvp4-pqmm", "packages": ["open-webui"], "path": "advisories/github-reviewed/2026/05/GHSA-57q6-fvp4-pqmm/GHSA-57q6-fvp4-pqmm.json", "severity": "MODERATE", "status": "changed", "summary": "Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header \u2014 full message processing on restricted endpoints"}, {"advisory": "https://github.com/advisories/GHSA-x6vc-x4v4-hjhr", "aliases": ["CVE-2026-57914"], "commit": "https://github.com/github/advisory-database/commit/f6c6cc756ae0690bde99e87dcfa980246865af49", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/f6c6cc756ae0690bde99e87dcfa980246865af49/advisories/github-reviewed/2026/06/GHSA-x6vc-x4v4-hjhr/GHSA-x6vc-x4v4-hjhr.json", "id": "GHSA-x6vc-x4v4-hjhr", "packages": ["org.apache.kerby:kerby-asn1"], "path": "advisories/github-reviewed/2026/06/GHSA-x6vc-x4v4-hjhr/GHSA-x6vc-x4v4-hjhr.json", "severity": "MODERATE", "status": "changed", "summary": "Apache Kerby vulnerable to denial of service"}, {"advisory": "https://github.com/advisories/GHSA-xrvj-h9w2-3q69", "aliases": ["CVE-2025-55017"], "commit": "https://github.com/github/advisory-database/commit/dfea14d0cd6ad3dab2d1cce70dcc7b978110402a", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/dfea14d0cd6ad3dab2d1cce70dcc7b978110402a/advisories/github-reviewed/2026/06/GHSA-xrvj-h9w2-3q69/GHSA-xrvj-h9w2-3q69.json", "id": "GHSA-xrvj-h9w2-3q69", "packages": ["org.apache.iotdb:iotdb-server"], "path": "advisories/github-reviewed/2026/06/GHSA-xrvj-h9w2-3q69/GHSA-xrvj-h9w2-3q69.json", "severity": "CRITICAL", "status": "published", "summary": "Apache IoTDB has a Path Traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-262p-fj3f-xh7v", "aliases": ["CVE-2026-57915"], "commit": "https://github.com/github/advisory-database/commit/0398025025eda364510f89231e300fc5cea2f1e4", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/0398025025eda364510f89231e300fc5cea2f1e4/advisories/github-reviewed/2026/06/GHSA-262p-fj3f-xh7v/GHSA-262p-fj3f-xh7v.json", "id": "GHSA-262p-fj3f-xh7v", "packages": ["org.apache.kerby:kerb-server"], "path": "advisories/github-reviewed/2026/06/GHSA-262p-fj3f-xh7v/GHSA-262p-fj3f-xh7v.json", "severity": "HIGH", "status": "changed", "summary": "Apache Kerby has a bypass the Kerberos pre-authentication check"}, {"advisory": "https://github.com/advisories/GHSA-h548-jhj8-q85h", "aliases": ["CVE-2025-64152"], "commit": "https://github.com/github/advisory-database/commit/0398025025eda364510f89231e300fc5cea2f1e4", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/0398025025eda364510f89231e300fc5cea2f1e4/advisories/github-reviewed/2026/06/GHSA-h548-jhj8-q85h/GHSA-h548-jhj8-q85h.json", "id": "GHSA-h548-jhj8-q85h", "packages": ["org.apache.iotdb:iotdb-server"], "path": "advisories/github-reviewed/2026/06/GHSA-h548-jhj8-q85h/GHSA-h548-jhj8-q85h.json", "severity": "CRITICAL", "status": "published", "summary": "Apache IoTDB has a Path Traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-72v2-v53v-4qmm", "aliases": ["CVE-2026-13426"], "commit": "https://github.com/github/advisory-database/commit/51487350d8faedb34ce51f2e868bff73324095e9", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/51487350d8faedb34ce51f2e868bff73324095e9/advisories/github-reviewed/2026/06/GHSA-72v2-v53v-4qmm/GHSA-72v2-v53v-4qmm.json", "id": "GHSA-72v2-v53v-4qmm", "packages": ["github.com/mattermost/mattermost/server/public"], "path": "advisories/github-reviewed/2026/06/GHSA-72v2-v53v-4qmm/GHSA-72v2-v53v-4qmm.json", "severity": "MODERATE", "status": "published", "summary": "github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction"}], "sourceId": "advisories-reviewed", "text": "On November 3, 2026, GitHub's security advisory list published 22 new advisories, changed 29, and withdrew 1. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 40531, "fingerprint": "59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc", "url": "https://flarereef.flareforward.com/files/watch/59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc.json"}}}, "parsed": {"counts": {"changed": 29, "published": 22, "removed": 0, "withdrawn": 1}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-03", "kind": "watch-day", "recordedAt": "2026-11-04T02:17:13Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-wp3j-xq48-xpjw", "aliases": ["CVE-2025-9566"], "commit": "https://github.com/github/advisory-database/commit/887dcb68f13a7d9be8bf3d604c2e32fc3d6960e8", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/887dcb68f13a7d9be8bf3d604c2e32fc3d6960e8/advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json", "id": "GHSA-wp3j-xq48-xpjw", "packages": ["github.com/containers/podman/v5", "github.com/containers/podman/v4"], "path": "advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json", "severity": "HIGH", "status": "changed", "summary": "podman kube play symlink traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-v653-r55g-hcmg", "aliases": ["CVE-2025-13327"], "commit": "https://github.com/github/advisory-database/commit/109512409477d1b7dfa372b0346a28a59d47e04d", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/109512409477d1b7dfa372b0346a28a59d47e04d/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "id": "GHSA-v653-r55g-hcmg", "packages": ["uv"], "path": "advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "severity": "MODERATE", "status": "changed", "summary": "uv has ZIP payload obfuscation through parsing differentials"}, {"advisory": "https://github.com/advisories/GHSA-f23m-r3pf-42rh", "aliases": ["CVE-2026-2950"], "commit": "https://github.com/github/advisory-database/commit/0b1941f7d05b03f4ed6469b0236dd3c59357f497", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/0b1941f7d05b03f4ed6469b0236dd3c59357f497/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json", "id": "GHSA-f23m-r3pf-42rh", "packages": ["lodash", "lodash-es", "lodash-amd", "lodash.unset", "lodash.omit"], "path": "advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json", "severity": "MODERATE", "status": "changed", "summary": "lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt"}, {"advisory": "https://github.com/advisories/GHSA-2cvf-wqm6-wr9g", "aliases": ["CVE-2026-94603"], "commit": "https://github.com/github/advisory-database/commit/b9d5dfa2061837f892e2cdbecfe33751bcd902fa", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/b9d5dfa2061837f892e2cdbecfe33751bcd902fa/advisories/github-reviewed/2026/10/GHSA-2cvf-wqm6-wr9g/GHSA-2cvf-wqm6-wr9g.json", "id": "GHSA-2cvf-wqm6-wr9g", "packages": ["github.com/containers/podman/v4", "go.podman.io/podman/v6", "github.com/containers/podman/v5"], "path": "advisories/github-reviewed/2026/10/GHSA-2cvf-wqm6-wr9g/GHSA-2cvf-wqm6-wr9g.json", "severity": "CRITICAL", "status": "changed", "summary": "Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation"}, {"advisory": "https://github.com/advisories/GHSA-23f4-hfmq-94mj", "aliases": ["CVE-2026-24807"], "commit": "https://github.com/github/advisory-database/commit/1cd5f193871f6f187dcd0bb684096313535d13dc", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/1cd5f193871f6f187dcd0bb684096313535d13dc/advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json", "id": "GHSA-23f4-hfmq-94mj", "packages": ["com.github.liuyueyi.media:batik-codec-fix"], "path": "advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json", "severity": "MODERATE", "status": "changed", "summary": "Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec"}, {"advisory": "https://github.com/advisories/GHSA-4c5c-2vc3-x5w2", "aliases": ["CVE-2024-27928"], "commit": "https://github.com/github/advisory-database/commit/09a0c50f4c060b454b1beba39b06607b692ae442", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/09a0c50f4c060b454b1beba39b06607b692ae442/advisories/github-reviewed/2026/06/GHSA-4c5c-2vc3-x5w2/GHSA-4c5c-2vc3-x5w2.json", "id": "GHSA-4c5c-2vc3-x5w2", "packages": ["vantage6"], "path": "advisories/github-reviewed/2026/06/GHSA-4c5c-2vc3-x5w2/GHSA-4c5c-2vc3-x5w2.json", "severity": "MODERATE", "status": "changed", "summary": "Vantage6: 2FA can be circumvented with hacked email access"}, {"advisory": "https://github.com/advisories/GHSA-5549-c5q7-fj65", "aliases": ["CVE-2024-24769"], "commit": "https://github.com/github/advisory-database/commit/3ad38b79a298df87ea7277ef69a97bdf8ac19070", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3ad38b79a298df87ea7277ef69a97bdf8ac19070/advisories/github-reviewed/2026/06/GHSA-5549-c5q7-fj65/GHSA-5549-c5q7-fj65.json", "id": "GHSA-5549-c5q7-fj65", "packages": ["vantage6"], "path": "advisories/github-reviewed/2026/06/GHSA-5549-c5q7-fj65/GHSA-5549-c5q7-fj65.json", "severity": "LOW", "status": "changed", "summary": "Vantage6: No limit on emails sent for password/MFA reset"}, {"advisory": "https://github.com/advisories/GHSA-gg2p-37pv-v7fq", "aliases": ["CVE-2026-18948"], "commit": "https://github.com/github/advisory-database/commit/2f5c9c3dc515527cf27c5dea15ea0c286b09a6a1", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/2f5c9c3dc515527cf27c5dea15ea0c286b09a6a1/advisories/github-reviewed/2026/08/GHSA-gg2p-37pv-v7fq/GHSA-gg2p-37pv-v7fq.json", "id": "GHSA-gg2p-37pv-v7fq", "packages": ["feast"], "path": "advisories/github-reviewed/2026/08/GHSA-gg2p-37pv-v7fq/GHSA-gg2p-37pv-v7fq.json", "severity": "CRITICAL", "status": "changed", "summary": "Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs"}, {"advisory": "https://github.com/advisories/GHSA-263q-5cv3-xq9g", "aliases": ["CVE-2025-68939"], "commit": "https://github.com/github/advisory-database/commit/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3/advisories/github-reviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json", "id": "GHSA-263q-5cv3-xq9g", "packages": ["code.gitea.io/gitea"], "path": "advisories/github-reviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json", "severity": "HIGH", "status": "changed", "summary": "Gitea allows attackers to add attachments with forbidden file extensions"}, {"advisory": "https://github.com/advisories/GHSA-2fqr-mr3j-6wp8", "aliases": ["CVE-2026-54279"], "commit": "https://github.com/github/advisory-database/commit/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3/advisories/github-reviewed/2026/06/GHSA-2fqr-mr3j-6wp8/GHSA-2fqr-mr3j-6wp8.json", "id": "GHSA-2fqr-mr3j-6wp8", "packages": ["aiohttp"], "path": "advisories/github-reviewed/2026/06/GHSA-2fqr-mr3j-6wp8/GHSA-2fqr-mr3j-6wp8.json", "severity": "LOW", "status": "changed", "summary": "aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence"}, {"advisory": "https://github.com/advisories/GHSA-m3qr-fvp4-78xj", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/20d31bd4c8caa6b82129e0d004e578e5cebe8f91", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/20d31bd4c8caa6b82129e0d004e578e5cebe8f91/advisories/github-reviewed/2026/11/GHSA-m3qr-fvp4-78xj/GHSA-m3qr-fvp4-78xj.json", "id": "GHSA-m3qr-fvp4-78xj", "packages": ["github.com/basekick-labs/arc"], "path": "advisories/github-reviewed/2026/11/GHSA-m3qr-fvp4-78xj/GHSA-m3qr-fvp4-78xj.json", "severity": "LOW", "status": "published", "summary": "Arc has unauthenticated application log disclosure via `/api/v1/logs`"}, {"advisory": "https://github.com/advisories/GHSA-h26j-4vp7-x9w2", "aliases": ["CVE-2026-62848"], "commit": "https://github.com/github/advisory-database/commit/5742631ca9236a1b99fb823b7dc5746894dc9c97", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/5742631ca9236a1b99fb823b7dc5746894dc9c97/advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json", "id": "GHSA-h26j-4vp7-x9w2", "packages": ["Metalama.Framework"], "path": "advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json", "severity": "HIGH", "status": "published", "summary": "Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution"}, {"advisory": "https://github.com/advisories/GHSA-9ppr-wfw9-xvr2", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/2c0fc1b40f792460bac314a3589ee722fddf9ab7", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2c0fc1b40f792460bac314a3589ee722fddf9ab7/advisories/github-reviewed/2026/11/GHSA-9ppr-wfw9-xvr2/GHSA-9ppr-wfw9-xvr2.json", "id": "GHSA-9ppr-wfw9-xvr2", "packages": ["github.com/tinfoil-factory/netfoil"], "path": "advisories/github-reviewed/2026/11/GHSA-9ppr-wfw9-xvr2/GHSA-9ppr-wfw9-xvr2.json", "severity": "MODERATE", "status": "published", "summary": "Netfoil doesn't decrement TTL"}, {"advisory": "https://github.com/advisories/GHSA-g27p-qf6j-c96c", "aliases": ["CVE-2026-102870"], "commit": "https://github.com/github/advisory-database/commit/0713d11c551f4fb074272b59e61c545ca28b395e", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/0713d11c551f4fb074272b59e61c545ca28b395e/advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "id": "GHSA-g27p-qf6j-c96c", "packages": ["Microsoft.AspNetCore.Components.WebAssembly.Server"], "path": "advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-4mpw-cpwj-hxxj", "aliases": ["CVE-2026-70197"], "commit": "https://github.com/github/advisory-database/commit/1b2b2b1ca2543a77a29a869f05f5d5ab9a48832d", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/1b2b2b1ca2543a77a29a869f05f5d5ab9a48832d/advisories/github-reviewed/2026/10/GHSA-4mpw-cpwj-hxxj/GHSA-4mpw-cpwj-hxxj.json", "id": "GHSA-4mpw-cpwj-hxxj", "packages": ["Microsoft.NETCore.App.Runtime.win-arm64", "Microsoft.NETCore.App.Runtime.win-x64", "Microsoft.NETCore.App.Runtime.win-x86"], "path": "advisories/github-reviewed/2026/10/GHSA-4mpw-cpwj-hxxj/GHSA-4mpw-cpwj-hxxj.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "aliases": ["CVE-2026-111497"], "commit": "https://github.com/github/advisory-database/commit/a8429404393e1324233442f9b6b686fa23906d49", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/a8429404393e1324233442f9b6b686fa23906d49/advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json", "id": "GHSA-9v8h-qqgm-4m35", "packages": ["brotli", "brotlicffi"], "path": "advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json", "severity": "CRITICAL", "status": "changed", "summary": "Brotli: Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package"}, {"advisory": "https://github.com/advisories/GHSA-g27p-qf6j-c96c", "aliases": ["CVE-2026-102870"], "commit": "https://github.com/github/advisory-database/commit/a8429404393e1324233442f9b6b686fa23906d49", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/a8429404393e1324233442f9b6b686fa23906d49/advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "id": "GHSA-g27p-qf6j-c96c", "packages": ["Microsoft.AspNetCore.Components.WebAssembly.Server"], "path": "advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-gqj5-2xp5-3qmp", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/6b4ca00b2205554fe416e66ca4f6bbaa419faff0", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/6b4ca00b2205554fe416e66ca4f6bbaa419faff0/advisories/github-reviewed/2026/06/GHSA-gqj5-2xp5-3qmp/GHSA-gqj5-2xp5-3qmp.json", "id": "GHSA-gqj5-2xp5-3qmp", "packages": ["org.keycloak:keycloak-services"], "path": "advisories/github-reviewed/2026/06/GHSA-gqj5-2xp5-3qmp/GHSA-gqj5-2xp5-3qmp.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Authentication bypass via jwt algorithm confusion"}, {"advisory": "https://github.com/advisories/GHSA-48v2-6jcm-fc99", "aliases": ["CVE-2026-62331"], "commit": "https://github.com/github/advisory-database/commit/2b369933cd4a9c17398ae7d4532f48e2ac48c173", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2b369933cd4a9c17398ae7d4532f48e2ac48c173/advisories/github-reviewed/2026/11/GHSA-48v2-6jcm-fc99/GHSA-48v2-6jcm-fc99.json", "id": "GHSA-48v2-6jcm-fc99", "packages": ["github.com/mtzanidakis/praktor"], "path": "advisories/github-reviewed/2026/11/GHSA-48v2-6jcm-fc99/GHSA-48v2-6jcm-fc99.json", "severity": "HIGH", "status": "published", "summary": "praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)"}, {"advisory": "https://github.com/advisories/GHSA-j97h-3f8r-mrjr", "aliases": ["CVE-2026-11800"], "commit": "https://github.com/github/advisory-database/commit/2b369933cd4a9c17398ae7d4532f48e2ac48c173", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/2b369933cd4a9c17398ae7d4532f48e2ac48c173/advisories/github-reviewed/2026/11/GHSA-j97h-3f8r-mrjr/GHSA-j97h-3f8r-mrjr.json", "id": "GHSA-j97h-3f8r-mrjr", "packages": ["org.keycloak:keycloak-services"], "path": "advisories/github-reviewed/2026/11/GHSA-j97h-3f8r-mrjr/GHSA-j97h-3f8r-mrjr.json", "severity": "HIGH", "status": "published", "summary": "Keycloak has authentication bypass via jwt algorithm confusion"}, {"advisory": "https://github.com/advisories/GHSA-p3jp-9v83-76w9", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/772fd8ac4b2e4d12a16d65630979ba79c9a7e82f", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/772fd8ac4b2e4d12a16d65630979ba79c9a7e82f/advisories/github-reviewed/2026/11/GHSA-p3jp-9v83-76w9/GHSA-p3jp-9v83-76w9.json", "id": "GHSA-p3jp-9v83-76w9", "packages": ["Microsoft.DotNet.ILCompiler", "Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64", "Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64", "Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64", "Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64", "Microsoft.NETCore.App.Runtime.Mono.android-arm", "Microsoft.NETCore.App.Runtime.Mono.android-arm64", "Microsoft.NETCore.App.Runtime.Mono.android-x64", "Microsoft.NETCore.App.Runtime.Mono.android-x86", "Microsoft.NETCore.App.Runtime.Mono.browser-wasm", "Microsoft.NETCore.App.Runtime.Mono.ios-arm64", "Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64", "Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64", "Microsoft.NETCore.App.Runtime.Mono.linux-arm", "Microsoft.NETCore.App.Runtime.Mono.linux-arm64", "Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64", "Microsoft.NETCore.App.Runtime.Mono.linux-x64", "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64", "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64", "Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm", "Microsoft.NETCore.App.Runtime.Mono.osx-arm64", "Microsoft.NETCore.App.Runtime.Mono.osx-x64", "Microsoft.NETCore.App.Runtime.Mono.tvos-arm64", "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64", "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64", "Microsoft.NETCore.App.Runtime.Mono.wasi-wasm", "Microsoft.NETCore.App.Runtime.Mono.win-x64", "Microsoft.NETCore.App.Runtime.Mono.win-x86", "Microsoft.NETCore.App.Runtime.linux-arm", "Microsoft.NETCore.App.Runtime.linux-arm64", "Microsoft.NETCore.App.Runtime.linux-bionic-arm64", "Microsoft.NETCore.App.Runtime.linux-bionic-x64", "Microsoft.NETCore.App.Runtime.linux-musl-arm", "Microsoft.NETCore.App.Runtime.linux-musl-arm64", "Microsoft.NETCore.App.Runtime.linux-musl-x64", "Microsoft.NETCore.App.Runtime.linux-x64", "Microsoft.NETCore.App.Runtime.osx-arm64", "Microsoft.NETCore.App.Runtime.osx-x64", "Microsoft.NETCore.App.Runtime.win-arm64", "Microsoft.NETCore.App.Runtime.win-x64", "Microsoft.NETCore.App.Runtime.win-x86", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.win-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.win-x86", "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.android-x64", "Microsoft.NETCore.App.Runtime.android-arm64", "Microsoft.NETCore.App.Runtime.android-x64", "Microsoft.NETCore.App.Runtime.android-arm", "Microsoft.NETCore.App.Runtime.browser-wasm", "Microsoft.NETCore.App.Runtime.ios-arm64", "Microsoft.NETCore.App.Runtime.iossimulator-arm64", "Microsoft.NETCore.App.Runtime.iossimulator-x64", "Microsoft.NETCore.App.Runtime.maccatalyst-arm64", "Microsoft.NETCore.App.Runtime.maccatalyst-x64", "Microsoft.NETCore.App.Runtime.tvos-arm64", "Microsoft.NETCore.App.Runtime.tvossimulator-arm64", "Microsoft.NETCore.App.Runtime.tvossimulator-x64"], "path": "advisories/github-reviewed/2026/11/GHSA-p3jp-9v83-76w9/GHSA-p3jp-9v83-76w9.json", "severity": "HIGH", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-8vvx-qvq9-5948", "aliases": ["CVE-2025-71338"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/03/GHSA-8vvx-qvq9-5948/GHSA-8vvx-qvq9-5948.json", "id": "GHSA-8vvx-qvq9-5948", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/03/GHSA-8vvx-qvq9-5948/GHSA-8vvx-qvq9-5948.json", "severity": "CRITICAL", "status": "changed", "summary": "Flowise allows arbitrary file write to RCE"}, {"advisory": "https://github.com/advisories/GHSA-3gf5-cxq9-w223", "aliases": ["CVE-2025-71340"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/08/GHSA-3gf5-cxq9-w223/GHSA-3gf5-cxq9-w223.json", "id": "GHSA-3gf5-cxq9-w223", "packages": ["picklescan"], "path": "advisories/github-reviewed/2025/08/GHSA-3gf5-cxq9-w223/GHSA-3gf5-cxq9-w223.json", "severity": "HIGH", "status": "changed", "summary": "Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode"}, {"advisory": "https://github.com/advisories/GHSA-6933-jpx5-q87q", "aliases": ["CVE-2025-71336"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/09/GHSA-6933-jpx5-q87q/GHSA-6933-jpx5-q87q.json", "id": "GHSA-6933-jpx5-q87q", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/09/GHSA-6933-jpx5-q87q/GHSA-6933-jpx5-q87q.json", "severity": "CRITICAL", "status": "changed", "summary": "Flowise has unsandboxed remote code execution via Custom MCP"}, {"advisory": "https://github.com/advisories/GHSA-q67q-549q-p849", "aliases": ["CVE-2025-71334"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/09/GHSA-q67q-549q-p849/GHSA-q67q-549q-p849.json", "id": "GHSA-q67q-549q-p849", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/09/GHSA-q67q-549q-p849/GHSA-q67q-549q-p849.json", "severity": "CRITICAL", "status": "changed", "summary": "Flowise has arbitrary file access due to missing chat flow id validation"}, {"advisory": "https://github.com/advisories/GHSA-273h-m46v-96q4", "aliases": ["CVE-2026-56367"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/02/GHSA-273h-m46v-96q4/GHSA-273h-m46v-96q4.json", "id": "GHSA-273h-m46v-96q4", "packages": ["Magick.NET-Q16-AnyCPU", "Magick.NET-Q16-HDRI-AnyCPU", "Magick.NET-Q16-HDRI-OpenMP-arm64", "Magick.NET-Q16-HDRI-OpenMP-x64", "Magick.NET-Q16-HDRI-arm64", "Magick.NET-Q16-HDRI-x64", "Magick.NET-Q16-HDRI-x86", "Magick.NET-Q16-OpenMP-arm64", "Magick.NET-Q16-OpenMP-x64", "Magick.NET-Q16-OpenMP-x86", "Magick.NET-Q16-arm64", "Magick.NET-Q16-x64", "Magick.NET-Q16-x86", "Magick.NET-Q8-AnyCPU", "Magick.NET-Q8-OpenMP-arm64", "Magick.NET-Q8-OpenMP-x64", "Magick.NET-Q8-arm64", "Magick.NET-Q8-x64", "Magick.NET-Q8-x86"], "path": "advisories/github-reviewed/2026/02/GHSA-273h-m46v-96q4/GHSA-273h-m46v-96q4.json", "severity": "LOW", "status": "changed", "summary": "ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds"}, {"advisory": "https://github.com/advisories/GHSA-c3hj-m5hq-59xw", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-c3hj-m5hq-59xw/GHSA-c3hj-m5hq-59xw.json", "id": "GHSA-c3hj-m5hq-59xw", "packages": ["flowise"], "path": "advisories/github-reviewed/2026/06/GHSA-c3hj-m5hq-59xw/GHSA-c3hj-m5hq-59xw.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory : Flowise allows arbitrary file write to RCE"}, {"advisory": "https://github.com/advisories/GHSA-mq7r-vm99-p7vx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-mq7r-vm99-p7vx/GHSA-mq7r-vm99-p7vx.json", "id": "GHSA-mq7r-vm99-p7vx", "packages": ["picklescan"], "path": "advisories/github-reviewed/2026/06/GHSA-mq7r-vm99-p7vx/GHSA-mq7r-vm99-p7vx.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode"}, {"advisory": "https://github.com/advisories/GHSA-q2xp-j85q-883h", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-q2xp-j85q-883h/GHSA-q2xp-j85q-883h.json", "id": "GHSA-q2xp-j85q-883h", "packages": ["flowise"], "path": "advisories/github-reviewed/2026/06/GHSA-q2xp-j85q-883h/GHSA-q2xp-j85q-883h.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP"}, {"advisory": "https://github.com/advisories/GHSA-rg39-4fm5-hrp2", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-rg39-4fm5-hrp2/GHSA-rg39-4fm5-hrp2.json", "id": "GHSA-rg39-4fm5-hrp2", "packages": ["Magick.NET-Q8-x86"], "path": "advisories/github-reviewed/2026/06/GHSA-rg39-4fm5-hrp2/GHSA-rg39-4fm5-hrp2.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds"}, {"advisory": "https://github.com/advisories/GHSA-w5r9-j49j-2m55", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-w5r9-j49j-2m55/GHSA-w5r9-j49j-2m55.json", "id": "GHSA-w5r9-j49j-2m55", "packages": ["flowise"], "path": "advisories/github-reviewed/2026/06/GHSA-w5r9-j49j-2m55/GHSA-w5r9-j49j-2m55.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory : Flowise has arbitrary file access due to missing chat flow id validation"}, {"advisory": "https://github.com/advisories/GHSA-q2hg-643c-gw8h", "aliases": ["CVE-2025-54550"], "commit": "https://github.com/github/advisory-database/commit/bfee4fa8fd91e14b833b776680f2381a9311a967", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/bfee4fa8fd91e14b833b776680f2381a9311a967/advisories/github-reviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json", "id": "GHSA-q2hg-643c-gw8h", "packages": ["apache-airflow"], "path": "advisories/github-reviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json", "severity": "HIGH", "status": "withdrawn", "summary": "Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag"}, {"advisory": "https://github.com/advisories/GHSA-x9rp-7wh3-2rj5", "aliases": ["CVE-2026-44265"], "commit": "https://github.com/github/advisory-database/commit/3166063e03a19d7eaa16d650902b995c4946ccac", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3166063e03a19d7eaa16d650902b995c4946ccac/advisories/github-reviewed/2026/11/GHSA-x9rp-7wh3-2rj5/GHSA-x9rp-7wh3-2rj5.json", "id": "GHSA-x9rp-7wh3-2rj5", "packages": ["@enspirit/elo"], "path": "advisories/github-reviewed/2026/11/GHSA-x9rp-7wh3-2rj5/GHSA-x9rp-7wh3-2rj5.json", "severity": "HIGH", "status": "published", "summary": "Elo backends have code injection via unvalidated emission of programmatic AST fields"}, {"advisory": "https://github.com/advisories/GHSA-33r5-xmm8-v6x5", "aliases": ["CVE-2026-44267"], "commit": "https://github.com/github/advisory-database/commit/7afed176f45c534bccb2f43fa4272d08dafd4efb", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7afed176f45c534bccb2f43fa4272d08dafd4efb/advisories/github-reviewed/2026/11/GHSA-33r5-xmm8-v6x5/GHSA-33r5-xmm8-v6x5.json", "id": "GHSA-33r5-xmm8-v6x5", "packages": ["@enspirit/elo"], "path": "advisories/github-reviewed/2026/11/GHSA-33r5-xmm8-v6x5/GHSA-33r5-xmm8-v6x5.json", "severity": "CRITICAL", "status": "published", "summary": "Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access"}, {"advisory": "https://github.com/advisories/GHSA-7w38-ggh5-v542", "aliases": ["CVE-2026-44266"], "commit": "https://github.com/github/advisory-database/commit/7afed176f45c534bccb2f43fa4272d08dafd4efb", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7afed176f45c534bccb2f43fa4272d08dafd4efb/advisories/github-reviewed/2026/11/GHSA-7w38-ggh5-v542/GHSA-7w38-ggh5-v542.json", "id": "GHSA-7w38-ggh5-v542", "packages": ["@enspirit/elo"], "path": "advisories/github-reviewed/2026/11/GHSA-7w38-ggh5-v542/GHSA-7w38-ggh5-v542.json", "severity": "CRITICAL", "status": "published", "summary": "Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels"}, {"advisory": "https://github.com/advisories/GHSA-m9cv-24rx-8mv7", "aliases": ["CVE-2026-55409"], "commit": "https://github.com/github/advisory-database/commit/bfb1ff7326519dc6a6f4a1ac745d1b011e5b17e4", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/bfb1ff7326519dc6a6f4a1ac745d1b011e5b17e4/advisories/github-reviewed/2026/06/GHSA-m9cv-24rx-8mv7/GHSA-m9cv-24rx-8mv7.json", "id": "GHSA-m9cv-24rx-8mv7", "packages": ["filament/forms"], "path": "advisories/github-reviewed/2026/06/GHSA-m9cv-24rx-8mv7/GHSA-m9cv-24rx-8mv7.json", "severity": "HIGH", "status": "changed", "summary": "Filament: Disabled RichEditor field state can be used for XSS"}, {"advisory": "https://github.com/advisories/GHSA-q6r4-3wmg-fwcq", "aliases": ["CVE-2026-55686"], "commit": "https://github.com/github/advisory-database/commit/c85a0fbb78e2cf8aa52f64a30136b1361c9751a1", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c85a0fbb78e2cf8aa52f64a30136b1361c9751a1/advisories/github-reviewed/2026/06/GHSA-q6r4-3wmg-fwcq/GHSA-q6r4-3wmg-fwcq.json", "id": "GHSA-q6r4-3wmg-fwcq", "packages": ["github.com/containers/podman/v5", "github.com/containers/podman/v4", "github.com/containers/podman/v3"], "path": "advisories/github-reviewed/2026/06/GHSA-q6r4-3wmg-fwcq/GHSA-q6r4-3wmg-fwcq.json", "severity": "MODERATE", "status": "changed", "summary": "Podman: WORKDIR symlink traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-9c4c-g95m-c8cp", "aliases": ["CVE-2025-71332"], "commit": "https://github.com/github/advisory-database/commit/2d4bd9ec59f215311b7e656b111083fc252ac893", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/2d4bd9ec59f215311b7e656b111083fc252ac893/advisories/github-reviewed/2025/04/GHSA-9c4c-g95m-c8cp/GHSA-9c4c-g95m-c8cp.json", "id": "GHSA-9c4c-g95m-c8cp", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/04/GHSA-9c4c-g95m-c8cp/GHSA-9c4c-g95m-c8cp.json", "severity": "HIGH", "status": "changed", "summary": "FlowiseDB vulnerable to SQL Injection by authenticated users"}, {"advisory": "https://github.com/advisories/GHSA-29hf-rm4x-xxph", "aliases": ["CVE-2026-55448"], "commit": "https://github.com/github/advisory-database/commit/b91a7d18bf660e4df3d16ce86ea8a4c5683e1a74", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/b91a7d18bf660e4df3d16ce86ea8a4c5683e1a74/advisories/github-reviewed/2026/06/GHSA-29hf-rm4x-xxph/GHSA-29hf-rm4x-xxph.json", "id": "GHSA-29hf-rm4x-xxph", "packages": ["mise"], "path": "advisories/github-reviewed/2026/06/GHSA-29hf-rm4x-xxph/GHSA-29hf-rm4x-xxph.json", "severity": "MODERATE", "status": "changed", "summary": "Mise's local credential_command executes untrusted config"}, {"advisory": "https://github.com/advisories/GHSA-gh9r-c94j-cmp5", "aliases": ["CVE-2026-115878"], "commit": "https://github.com/github/advisory-database/commit/17f6aad969d6fbf66d428725d56c65072693f130", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/17f6aad969d6fbf66d428725d56c65072693f130/advisories/github-reviewed/2026/11/GHSA-gh9r-c94j-cmp5/GHSA-gh9r-c94j-cmp5.json", "id": "GHSA-gh9r-c94j-cmp5", "packages": ["stanza"], "path": "advisories/github-reviewed/2026/11/GHSA-gh9r-c94j-cmp5/GHSA-gh9r-c94j-cmp5.json", "severity": "HIGH", "status": "published", "summary": "Stanza: RCE via pickle deserialization in the lemmatizer"}, {"advisory": "https://github.com/advisories/GHSA-68wq-phq7-p2vg", "aliases": ["CVE-2026-55186"], "commit": "https://github.com/github/advisory-database/commit/e283ff073919b1843af36729a333698cb9816520", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/e283ff073919b1843af36729a333698cb9816520/advisories/github-reviewed/2026/10/GHSA-68wq-phq7-p2vg/GHSA-68wq-phq7-p2vg.json", "id": "GHSA-68wq-phq7-p2vg", "packages": ["silverstripe/mfa"], "path": "advisories/github-reviewed/2026/10/GHSA-68wq-phq7-p2vg/GHSA-68wq-phq7-p2vg.json", "severity": "MODERATE", "status": "changed", "summary": "MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow"}, {"advisory": "https://github.com/advisories/GHSA-7pm4-56h2-5rxr", "aliases": ["CVE-2026-5366"], "commit": "https://github.com/github/advisory-database/commit/133ace55605a3f3e9f4331c0643c69660c0efdfa", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/133ace55605a3f3e9f4331c0643c69660c0efdfa/advisories/github-reviewed/2026/06/GHSA-7pm4-56h2-5rxr/GHSA-7pm4-56h2-5rxr.json", "id": "GHSA-7pm4-56h2-5rxr", "packages": ["prefect"], "path": "advisories/github-reviewed/2026/06/GHSA-7pm4-56h2-5rxr/GHSA-7pm4-56h2-5rxr.json", "severity": "CRITICAL", "status": "published", "summary": "Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)"}, {"advisory": "https://github.com/advisories/GHSA-q63x-9pfm-mjx4", "aliases": ["CVE-2026-56121"], "commit": "https://github.com/github/advisory-database/commit/e129255cb37f297a5bc876a9e362d34a443f9d5f", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/e129255cb37f297a5bc876a9e362d34a443f9d5f/advisories/github-reviewed/2026/06/GHSA-q63x-9pfm-mjx4/GHSA-q63x-9pfm-mjx4.json", "id": "GHSA-q63x-9pfm-mjx4", "packages": ["feast"], "path": "advisories/github-reviewed/2026/06/GHSA-q63x-9pfm-mjx4/GHSA-q63x-9pfm-mjx4.json", "severity": "CRITICAL", "status": "changed", "summary": "Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto"}, {"advisory": "https://github.com/advisories/GHSA-qj64-jj84-w38j", "aliases": ["CVE-2026-56091"], "commit": "https://github.com/github/advisory-database/commit/e129255cb37f297a5bc876a9e362d34a443f9d5f", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/e129255cb37f297a5bc876a9e362d34a443f9d5f/advisories/github-reviewed/2026/06/GHSA-qj64-jj84-w38j/GHSA-qj64-jj84-w38j.json", "id": "GHSA-qj64-jj84-w38j", "packages": ["org.apache.shiro:shiro-guice"], "path": "advisories/github-reviewed/2026/06/GHSA-qj64-jj84-w38j/GHSA-qj64-jj84-w38j.json", "severity": "HIGH", "status": "published", "summary": "Apache Shiro shiro-guice module vulnerable to authentication bypass"}, {"advisory": "https://github.com/advisories/GHSA-m8g6-vrr2-x7ff", "aliases": ["CVE-2026-56130"], "commit": "https://github.com/github/advisory-database/commit/acf5bcf01917d2e611bf2966c2e38ee282bc071a", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/acf5bcf01917d2e611bf2966c2e38ee282bc071a/advisories/github-reviewed/2026/06/GHSA-m8g6-vrr2-x7ff/GHSA-m8g6-vrr2-x7ff.json", "id": "GHSA-m8g6-vrr2-x7ff", "packages": ["org.apache.shiro:shiro-core", "org.apache.shiro:shiro-web"], "path": "advisories/github-reviewed/2026/06/GHSA-m8g6-vrr2-x7ff/GHSA-m8g6-vrr2-x7ff.json", "severity": "LOW", "status": "published", "summary": "Apache Shiro's \"remember me\" cookie age is not verified on the server."}, {"advisory": "https://github.com/advisories/GHSA-p2gc-fm5w-94jj", "aliases": ["CVE-2026-66274"], "commit": "https://github.com/github/advisory-database/commit/c84527072ba4f605ae401866e29fb9d00bda7017", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/c84527072ba4f605ae401866e29fb9d00bda7017/advisories/github-reviewed/2026/08/GHSA-p2gc-fm5w-94jj/GHSA-p2gc-fm5w-94jj.json", "id": "GHSA-p2gc-fm5w-94jj", "packages": ["org.apache.qpid:proton-j"], "path": "advisories/github-reviewed/2026/08/GHSA-p2gc-fm5w-94jj/GHSA-p2gc-fm5w-94jj.json", "severity": "HIGH", "status": "changed", "summary": "Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow"}, {"advisory": "https://github.com/advisories/GHSA-57q6-fvp4-pqmm", "aliases": ["CVE-2026-45339"], "commit": "https://github.com/github/advisory-database/commit/54ea6b928d36e4a9a41a26ac072524b191634fd8", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/54ea6b928d36e4a9a41a26ac072524b191634fd8/advisories/github-reviewed/2026/05/GHSA-57q6-fvp4-pqmm/GHSA-57q6-fvp4-pqmm.json", "id": "GHSA-57q6-fvp4-pqmm", "packages": ["open-webui"], "path": "advisories/github-reviewed/2026/05/GHSA-57q6-fvp4-pqmm/GHSA-57q6-fvp4-pqmm.json", "severity": "MODERATE", "status": "changed", "summary": "Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header \u2014 full message processing on restricted endpoints"}, {"advisory": "https://github.com/advisories/GHSA-x6vc-x4v4-hjhr", "aliases": ["CVE-2026-57914"], "commit": "https://github.com/github/advisory-database/commit/f6c6cc756ae0690bde99e87dcfa980246865af49", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/f6c6cc756ae0690bde99e87dcfa980246865af49/advisories/github-reviewed/2026/06/GHSA-x6vc-x4v4-hjhr/GHSA-x6vc-x4v4-hjhr.json", "id": "GHSA-x6vc-x4v4-hjhr", "packages": ["org.apache.kerby:kerby-asn1"], "path": "advisories/github-reviewed/2026/06/GHSA-x6vc-x4v4-hjhr/GHSA-x6vc-x4v4-hjhr.json", "severity": "MODERATE", "status": "changed", "summary": "Apache Kerby vulnerable to denial of service"}, {"advisory": "https://github.com/advisories/GHSA-xrvj-h9w2-3q69", "aliases": ["CVE-2025-55017"], "commit": "https://github.com/github/advisory-database/commit/dfea14d0cd6ad3dab2d1cce70dcc7b978110402a", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/dfea14d0cd6ad3dab2d1cce70dcc7b978110402a/advisories/github-reviewed/2026/06/GHSA-xrvj-h9w2-3q69/GHSA-xrvj-h9w2-3q69.json", "id": "GHSA-xrvj-h9w2-3q69", "packages": ["org.apache.iotdb:iotdb-server"], "path": "advisories/github-reviewed/2026/06/GHSA-xrvj-h9w2-3q69/GHSA-xrvj-h9w2-3q69.json", "severity": "CRITICAL", "status": "published", "summary": "Apache IoTDB has a Path Traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-262p-fj3f-xh7v", "aliases": ["CVE-2026-57915"], "commit": "https://github.com/github/advisory-database/commit/0398025025eda364510f89231e300fc5cea2f1e4", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/0398025025eda364510f89231e300fc5cea2f1e4/advisories/github-reviewed/2026/06/GHSA-262p-fj3f-xh7v/GHSA-262p-fj3f-xh7v.json", "id": "GHSA-262p-fj3f-xh7v", "packages": ["org.apache.kerby:kerb-server"], "path": "advisories/github-reviewed/2026/06/GHSA-262p-fj3f-xh7v/GHSA-262p-fj3f-xh7v.json", "severity": "HIGH", "status": "changed", "summary": "Apache Kerby has a bypass the Kerberos pre-authentication check"}, {"advisory": "https://github.com/advisories/GHSA-h548-jhj8-q85h", "aliases": ["CVE-2025-64152"], "commit": "https://github.com/github/advisory-database/commit/0398025025eda364510f89231e300fc5cea2f1e4", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/0398025025eda364510f89231e300fc5cea2f1e4/advisories/github-reviewed/2026/06/GHSA-h548-jhj8-q85h/GHSA-h548-jhj8-q85h.json", "id": "GHSA-h548-jhj8-q85h", "packages": ["org.apache.iotdb:iotdb-server"], "path": "advisories/github-reviewed/2026/06/GHSA-h548-jhj8-q85h/GHSA-h548-jhj8-q85h.json", "severity": "CRITICAL", "status": "published", "summary": "Apache IoTDB has a Path Traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-72v2-v53v-4qmm", "aliases": ["CVE-2026-13426"], "commit": "https://github.com/github/advisory-database/commit/51487350d8faedb34ce51f2e868bff73324095e9", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/51487350d8faedb34ce51f2e868bff73324095e9/advisories/github-reviewed/2026/06/GHSA-72v2-v53v-4qmm/GHSA-72v2-v53v-4qmm.json", "id": "GHSA-72v2-v53v-4qmm", "packages": ["github.com/mattermost/mattermost/server/public"], "path": "advisories/github-reviewed/2026/06/GHSA-72v2-v53v-4qmm/GHSA-72v2-v53v-4qmm.json", "severity": "MODERATE", "status": "published", "summary": "github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction"}], "sourceId": "advisories-reviewed", "text": "On November 3, 2026, GitHub's security advisory list published 22 new advisories, changed 29, and withdrew 1. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 40531, "fingerprint": "59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc", "url": "https://flarereef.flareforward.com/files/watch/59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc.json"}}, "project": {"projectId": 20, "name": "Security advisories (GitHub reviewed)", "kind": "watch", "keeper": "GitHub", "jurisdiction": "", "markText": "GH", "shape": "", "what": "GitHub's security advisory list", "repoUrl": "https://github.com/github/advisory-database", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "chunk": "day"}, "date": "2026-11-04", "author": {"name": "Flare Reef watcher", "handle": "", "verified": false}}