{"note": {"noteId": 430, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0x9f0853e6bd8162f6bae2dbf39f4e6c5dbf77399bae4b69f8ecb0a2370e2f4f74", "content": "{\"counts\":{\"changed\":46,\"published\":17,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-04\",\"fullList\":{\"bytes\":45785,\"fingerprint\":\"0d8a3a45dccea10473d5af150a64019a8d4eb56063609241430aa676b5f08c26\",\"url\":\"https://flarereef.flareforward.com/files/watch/0d8a3a45dccea10473d5af150a64019a8d4eb56063609241430aa676b5f08c26.json\"},\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-05T02:02:47Z\",\"rows\":[{\"advisory\":\"https://github.com/advisories/GHSA-7p85-w9px-jpjp\",\"aliases\":[\"CVE-2026-46633\"],\"commit\":\"https://github.com/github/advisory-database/commit/8d8209a50cacdad85184e017ac9d9cec92b4e0cb\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/8d8209a50cacdad85184e017ac9d9cec92b4e0cb/advisories/github-reviewed/2026/05/GHSA-7p85-w9px-jpjp/GHSA-7p85-w9px-jpjp.json\",\"id\":\"GHSA-7p85-w9px-jpjp\",\"packages\":[\"twig/twig\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-7p85-w9px-jpjp/GHSA-7p85-w9px-jpjp.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Twig: PHP code injection via `{% use %}` template name\"},{\"advisory\":\"https://github.com/advisories/GHSA-659w-93r5-9j6m\",\"aliases\":[\"CVE-2026-42440\"],\"commit\":\"https://github.com/github/advisory-database/commit/d29f93b34c304df05cd3a23ea898c61ebb69d2ea\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/d29f93b34c304df05cd3a23ea898c61ebb69d2ea/advisories/github-reviewed/2026/05/GHSA-659w-93r5-9j6m/GHSA-659w-93r5-9j6m.json\",\"id\":\"GHSA-659w-93r5-9j6m\",\"packages\":[\"org.apache.opennlp:opennlp-tools\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-659w-93r5-9j6m/GHSA-659w-93r5-9j6m.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation\"},{\"advisory\":\"https://github.com/advisories/GHSA-63cw-57p8-fm3p\",\"aliases\":[\"CVE-2026-24747\"],\"commit\":\"https://github.com/github/advisory-database/commit/568487bb4bb7928f51234182640bce237067a8c9\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/568487bb4bb7928f51234182640bce237067a8c9/advisories/github-reviewed/2026/01/GHSA-63cw-57p8-fm3p/GHSA-63cw-57p8-fm3p.json\",\"id\":\"GHSA-63cw-57p8-fm3p\",\"packages\":[\"torch\"],\"path\":\"advisories/github-reviewed/2026/01/GHSA-63cw-57p8-fm3p/GHSA-63cw-57p8-fm3p.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files\"},{\"advisory\":\"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg\",\"aliases\":[\"CVE-2025-13465\"],\"commit\":\"https://github.com/github/advisory-database/commit/378cd3bf07dd1a59610cd65c576008e5b586979f\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/378cd3bf07dd1a59610cd65c576008e5b586979f/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json\",\"id\":\"GHSA-xxjr-mmjv-4gpg\",\"packages\":[\"lodash\",\"lodash-amd\",\"lodash-es\",\"lodash.omit\",\"lodash.unset\"],\"path\":\"advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions\"},{\"advisory\":\"https://github.com/advisories/GHSA-mgp5-rv84-w37q\",\"aliases\":[\"CVE-2026-24734\"],\"commit\":\"https://github.com/github/advisory-database/commit/5f5b41b00513c7ce1e843053d1d22999dafca0b0\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/5f5b41b00513c7ce1e843053d1d22999dafca0b0/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json\",\"id\":\"GHSA-mgp5-rv84-w37q\",\"packages\":[\"org.apache.tomcat:tomcat-coyote\",\"org.apache.tomcat.embed:tomcat-embed-core\",\"org.apache.tomcat:tomcat-coyote-ffm\"],\"path\":\"advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Apache Tomcat has an Improper Input Validation vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-68j8-pq59-fqgm\",\"aliases\":[\"CVE-2026-0847\"],\"commit\":\"https://github.com/github/advisory-database/commit/5f5b41b00513c7ce1e843053d1d22999dafca0b0\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/5f5b41b00513c7ce1e843053d1d22999dafca0b0/advisories/github-reviewed/2026/03/GHSA-68j8-pq59-fqgm/GHSA-68j8-pq59-fqgm.json\",\"id\":\"GHSA-68j8-pq59-fqgm\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-68j8-pq59-fqgm/GHSA-68j8-pq59-fqgm.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"NLTK has a Path Traversal issue\"},{\"advisory\":\"https://github.com/advisories/GHSA-3r9x-f23j-gc73\",\"aliases\":[\"CVE-2026-27489\"],\"commit\":\"https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/03/GHSA-3r9x-f23j-gc73/GHSA-3r9x-f23j-gc73.json\",\"id\":\"GHSA-3r9x-f23j-gc73\",\"packages\":[\"onnx\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-3r9x-f23j-gc73/GHSA-3r9x-f23j-gc73.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"onnx Vulnerable to Path Traversal via Symlink\"},{\"advisory\":\"https://github.com/advisories/GHSA-469j-vmhf-r6v7\",\"aliases\":[\"CVE-2026-33236\"],\"commit\":\"https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/03/GHSA-469j-vmhf-r6v7/GHSA-469j-vmhf-r6v7.json\",\"id\":\"GHSA-469j-vmhf-r6v7\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-469j-vmhf-r6v7/GHSA-469j-vmhf-r6v7.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite\"},{\"advisory\":\"https://github.com/advisories/GHSA-qr99-7898-vr7c\",\"aliases\":[\"CVE-2026-33433\"],\"commit\":\"https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/03/GHSA-qr99-7898-vr7c/GHSA-qr99-7898-vr7c.json\",\"id\":\"GHSA-qr99-7898-vr7c\",\"packages\":[\"github.com/traefik/traefik/v2\",\"github.com/traefik/traefik/v3\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-qr99-7898-vr7c/GHSA-qr99-7898-vr7c.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField\"},{\"advisory\":\"https://github.com/advisories/GHSA-p423-j2cm-9vmq\",\"aliases\":[\"CVE-2026-39892\"],\"commit\":\"https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/04/GHSA-p423-j2cm-9vmq/GHSA-p423-j2cm-9vmq.json\",\"id\":\"GHSA-p423-j2cm-9vmq\",\"packages\":[\"cryptography\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-p423-j2cm-9vmq/GHSA-p423-j2cm-9vmq.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs\"},{\"advisory\":\"https://github.com/advisories/GHSA-p93r-85wp-75v3\",\"aliases\":[\"CVE-2026-5598\"],\"commit\":\"https://github.com/github/advisory-database/commit/fd0f6e20b23c4d395ac90a0f97fe2f4fad2b1cd3\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/fd0f6e20b23c4d395ac90a0f97fe2f4fad2b1cd3/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json\",\"id\":\"GHSA-p93r-85wp-75v3\",\"packages\":[\"org.bouncycastle:bcprov-jdk15to18\",\"org.bouncycastle:bcprov-jdk14\",\"org.bouncycastle:bcprov-jdk18on\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Bouncy Castle Has Covert Timing Channel Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-c3fc-8qff-9hwx\",\"aliases\":[\"CVE-2026-0636\"],\"commit\":\"https://github.com/github/advisory-database/commit/257898fe95916c61b45527df993e2f2fa485bf94\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/257898fe95916c61b45527df993e2f2fa485bf94/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json\",\"id\":\"GHSA-c3fc-8qff-9hwx\",\"packages\":[\"org.bouncycastle:bcprov-jdk14\",\"org.bouncycastle:bcprov-jdk15to18\",\"org.bouncycastle:bcprov-jdk18on\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Bouncy Castle has an LDAP injection\"},{\"advisory\":\"https://github.com/advisories/GHSA-v3vg-332r-mw99\",\"aliases\":[\"CVE-2026-40048\"],\"commit\":\"https://github.com/github/advisory-database/commit/c838fdf54fffc232e4559792eb1b1b915d5b0d60\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/c838fdf54fffc232e4559792eb1b1b915d5b0d60/advisories/github-reviewed/2026/04/GHSA-v3vg-332r-mw99/GHSA-v3vg-332r-mw99.json\",\"id\":\"GHSA-v3vg-332r-mw99\",\"packages\":[\"org.apache.camel:camel-pqc\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-v3vg-332r-mw99/GHSA-v3vg-332r-mw99.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Camel-PQC Vulnerable to Deserialization of Untrusted Data\"},{\"advisory\":\"https://github.com/advisories/GHSA-26hh-7cqf-hhc6\",\"aliases\":[\"CVE-2026-45109\"],\"commit\":\"https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-26hh-7cqf-hhc6/GHSA-26hh-7cqf-hhc6.json\",\"id\":\"GHSA-26hh-7cqf-hhc6\",\"packages\":[\"next\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-26hh-7cqf-hhc6/GHSA-26hh-7cqf-hhc6.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up\"},{\"advisory\":\"https://github.com/advisories/GHSA-55hx-c926-fr95\",\"aliases\":[\"CVE-2026-26332\"],\"commit\":\"https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-55hx-c926-fr95/GHSA-55hx-c926-fr95.json\",\"id\":\"GHSA-55hx-c926-fr95\",\"packages\":[\"vm2\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-55hx-c926-fr95/GHSA-55hx-c926-fr95.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"VM2 Has a Sandbox Escape Issue via SuppressedError\"},{\"advisory\":\"https://github.com/advisories/GHSA-grj5-jjm8-h35p\",\"aliases\":[\"CVE-2026-24118\"],\"commit\":\"https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-grj5-jjm8-h35p/GHSA-grj5-jjm8-h35p.json\",\"id\":\"GHSA-grj5-jjm8-h35p\",\"packages\":[\"vm2\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-grj5-jjm8-h35p/GHSA-grj5-jjm8-h35p.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"VM2 Sandbox Breakout Through __lookupGetter__\"},{\"advisory\":\"https://github.com/advisories/GHSA-v37h-5mfm-c47c\",\"aliases\":[\"CVE-2026-24781\"],\"commit\":\"https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-v37h-5mfm-c47c/GHSA-v37h-5mfm-c47c.json\",\"id\":\"GHSA-v37h-5mfm-c47c\",\"packages\":[\"vm2\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-v37h-5mfm-c47c/GHSA-v37h-5mfm-c47c.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"VM2 Has Sandbox Breakout Through Inspect Function\"},{\"advisory\":\"https://github.com/advisories/GHSA-8hg8-63c5-gwmx\",\"aliases\":[\"CVE-2026-44007\"],\"commit\":\"https://github.com/github/advisory-database/commit/f5a2d1ff6e7b5791366faa2b74615534a1a1462e\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/f5a2d1ff6e7b5791366faa2b74615534a1a1462e/advisories/github-reviewed/2026/05/GHSA-8hg8-63c5-gwmx/GHSA-8hg8-63c5-gwmx.json\",\"id\":\"GHSA-8hg8-63c5-gwmx\",\"packages\":[\"vm2\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-8hg8-63c5-gwmx/GHSA-8hg8-63c5-gwmx.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution\"},{\"advisory\":\"https://github.com/advisories/GHSA-9qj6-qjgg-37qq\",\"aliases\":[\"CVE-2026-44008\"],\"commit\":\"https://github.com/github/advisory-database/commit/f5a2d1ff6e7b5791366faa2b74615534a1a1462e\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/f5a2d1ff6e7b5791366faa2b74615534a1a1462e/advisories/github-reviewed/2026/05/GHSA-9qj6-qjgg-37qq/GHSA-9qj6-qjgg-37qq.json\",\"id\":\"GHSA-9qj6-qjgg-37qq\",\"packages\":[\"vm2\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-9qj6-qjgg-37qq/GHSA-9qj6-qjgg-37qq.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`\"},{\"advisory\":\"https://github.com/advisories/GHSA-9vg3-4rfj-wgcm\",\"aliases\":[\"CVE-2026-44009\"],\"commit\":\"https://github.com/github/advisory-database/commit/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f/advisories/github-reviewed/2026/05/GHSA-9vg3-4rfj-wgcm/GHSA-9vg3-4rfj-wgcm.json\",\"id\":\"GHSA-9vg3-4rfj-wgcm\",\"packages\":[\"vm2\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-9vg3-4rfj-wgcm/GHSA-9vg3-4rfj-wgcm.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"vm2 has Sandbox Breakout Through Null Proto Exception\"},{\"advisory\":\"https://github.com/advisories/GHSA-vxpw-j846-p89q\",\"aliases\":[\"CVE-2026-12151\"],\"commit\":\"https://github.com/github/advisory-database/commit/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f/advisories/github-reviewed/2026/06/GHSA-vxpw-j846-p89q/GHSA-vxpw-j846-p89q.json\",\"id\":\"GHSA-vxpw-j846-p89q\",\"packages\":[\"undici\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-vxpw-j846-p89q/GHSA-vxpw-j846-p89q.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"undici WebSocket client vulnerable to denial of service via fragment count bypass\"},{\"advisory\":\"https://github.com/advisories/GHSA-wp3c-266w-4qfq\",\"aliases\":[\"CVE-2026-49293\"],\"commit\":\"https://github.com/github/advisory-database/commit/557871daae102762572edbc32c842a7a1a46113a\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/557871daae102762572edbc32c842a7a1a46113a/advisories/github-reviewed/2026/06/GHSA-wp3c-266w-4qfq/GHSA-wp3c-266w-4qfq.json\",\"id\":\"GHSA-wp3c-266w-4qfq\",\"packages\":[\"js-toml\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-wp3c-266w-4qfq/GHSA-wp3c-266w-4qfq.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals\"},{\"advisory\":\"https://github.com/advisories/GHSA-3fxj-6jh8-hvhx\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/9476a7ac3483db5eb8a2acf162787ffc27bebd6c\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/9476a7ac3483db5eb8a2acf162787ffc27bebd6c/advisories/github-reviewed/2026/06/GHSA-3fxj-6jh8-hvhx/GHSA-3fxj-6jh8-hvhx.json\",\"id\":\"GHSA-3fxj-6jh8-hvhx\",\"packages\":[\"github.com/go-chi/chi/v5/middleware\",\"github.com/go-chi/chi/v5\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-3fxj-6jh8-hvhx/GHSA-3fxj-6jh8-hvhx.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"chi Has an IP Spoofing Vulnerability in `middleware.RealIP`\"},{\"advisory\":\"https://github.com/advisories/GHSA-rp2p-6cmp-jxj9\",\"aliases\":[\"CVE-2026-57108\"],\"commit\":\"https://github.com/github/advisory-database/commit/3c82703bb98b8d802b37a346686bdc5a605056a2\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/3c82703bb98b8d802b37a346686bdc5a605056a2/advisories/github-reviewed/2026/07/GHSA-rp2p-6cmp-jxj9/GHSA-rp2p-6cmp-jxj9.json\",\"id\":\"GHSA-rp2p-6cmp-jxj9\",\"packages\":[\"Microsoft.NetCore.App.Runtime.linux-arm\",\"Microsoft.NetCore.App.Runtime.linux-arm64\",\"Microsoft.NetCore.App.Runtime.linux-musl-arm\",\"Microsoft.NetCore.App.Runtime.linux-musl-arm64\",\"Microsoft.NetCore.App.Runtime.linux-musl-x64\",\"Microsoft.NetCore.App.Runtime.linux-x64\",\"Microsoft.NetCore.App.Runtime.osx-arm64\",\"Microsoft.NetCore.App.Runtime.osx-x64\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-rp2p-6cmp-jxj9/GHSA-rp2p-6cmp-jxj9.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Microsoft Security Advisory CVE-2026-57108 \u2013 .NET Denial of Service Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-2969-4q4w-w5h3\",\"aliases\":[\"CVE-2026-50650\"],\"commit\":\"https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/07/GHSA-2969-4q4w-w5h3/GHSA-2969-4q4w-w5h3.json\",\"id\":\"GHSA-2969-4q4w-w5h3\",\"packages\":[\"Microsoft.WindowsDesktop.App.Runtime.win-x64\",\"Microsoft.WindowsDesktop.App.Runtime.win-x86\",\"Microsoft.WindowsDesktop.App.Runtime.win-arm64\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-2969-4q4w-w5h3/GHSA-2969-4q4w-w5h3.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Microsoft Security Advisory CVE-2026-50650 \u2013 .NET Elevation of Privilege Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-w7cw-xp7h-6j5j\",\"aliases\":[\"CVE-2026-50524\"],\"commit\":\"https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/07/GHSA-w7cw-xp7h-6j5j/GHSA-w7cw-xp7h-6j5j.json\",\"id\":\"GHSA-w7cw-xp7h-6j5j\",\"packages\":[\"Microsoft.NetCore.App.Runtime.linux-arm\",\"Microsoft.NetCore.App.Runtime.linux-arm64\",\"Microsoft.NetCore.App.Runtime.linux-musl-arm\",\"Microsoft.NetCore.App.Runtime.linux-musl-arm64\",\"Microsoft.NetCore.App.Runtime.linux-musl-x64\",\"Microsoft.NetCore.App.Runtime.linux-x64\",\"Microsoft.NetCore.App.Runtime.osx-arm64\",\"Microsoft.NetCore.App.Runtime.osx-x64\",\"Microsoft.NetCore.App.Runtime.win-arm\",\"Microsoft.NetCore.App.Runtime.win-arm64\",\"Microsoft.NetCore.App.Runtime.win-x64\",\"Microsoft.NetCore.App.Runtime.win-x86\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-w7cw-xp7h-6j5j/GHSA-w7cw-xp7h-6j5j.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Microsoft Security Advisory CVE-2026-50524 \u2013 .NET Denial of Service Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-wp74-jgxh-gv4q\",\"aliases\":[\"CVE-2026-50651\"],\"commit\":\"https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/07/GHSA-wp74-jgxh-gv4q/GHSA-wp74-jgxh-gv4q.json\",\"id\":\"GHSA-wp74-jgxh-gv4q\",\"packages\":[\"Microsoft.NetCore.App.Runtime.linux-arm\",\"Microsoft.NetCore.App.Runtime.linux-arm64\",\"Microsoft.NetCore.App.Runtime.linux-musl-arm\",\"Microsoft.NetCore.App.Runtime.linux-musl-arm64\",\"Microsoft.NetCore.App.Runtime.linux-musl-x64\",\"Microsoft.NetCore.App.Runtime.linux-x64\",\"Microsoft.NetCore.App.Runtime.osx-arm64\",\"Microsoft.NetCore.App.Runtime.osx-x64\",\"Microsoft.NetCore.App.Runtime.win-arm\",\"Microsoft.NetCore.App.Runtime.win-arm64\",\"Microsoft.NetCore.App.Runtime.win-x64\",\"Microsoft.NetCore.App.Runtime.win-x86\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-wp74-jgxh-gv4q/GHSA-wp74-jgxh-gv4q.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Microsoft Security Advisory CVE-2026-50651 \u2013 .NET Denial of Service Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-2j8r-3c22-8565\",\"aliases\":[\"CVE-2026-69522\"],\"commit\":\"https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/09/GHSA-2j8r-3c22-8565/GHSA-2j8r-3c22-8565.json\",\"id\":\"GHSA-2j8r-3c22-8565\",\"packages\":[\"Microsoft.DiaSymReader.Native\"],\"path\":\"advisories/github-reviewed/2026/09/GHSA-2j8r-3c22-8565/GHSA-2j8r-3c22-8565.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Microsoft Security Advisory CVE-2026-69522 \u2013 .NET and Visual Studio Remote Code Execution Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-v653-r55g-hcmg\",\"aliases\":[\"CVE-2025-13327\"],\"commit\":\"https://github.com/github/advisory-database/commit/7b9d4a76d57210c31547ee6aa9a88f906d4211f0\",\"ecosystems\":[\"crates.io\"],\"file\":\"https://github.com/github/advisory-database/blob/7b9d4a76d57210c31547ee6aa9a88f906d4211f0/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json\",\"id\":\"GHSA-v653-r55g-hcmg\",\"packages\":[\"uv\"],\"path\":\"advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"uv has ZIP payload obfuscation through parsing differentials\"},{\"advisory\":\"https://github.com/advisories/GHSA-h5gm-rvw6-2xpx\",\"aliases\":[\"CVE-2026-49434\"],\"commit\":\"https://github.com/github/advisory-database/commit/9d0e960825d8c8d78f6c45f2a23b9a641a0fcd94\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/9d0e960825d8c8d78f6c45f2a23b9a641a0fcd94/advisories/github-reviewed/2026/06/GHSA-h5gm-rvw6-2xpx/GHSA-h5gm-rvw6-2xpx.json\",\"id\":\"GHSA-h5gm-rvw6-2xpx\",\"packages\":[\"org.apache.activemq:activemq-broker\",\"org.apache.activemq:apache-activemq\",\"org.apache.activemq:activemq-all\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-h5gm-rvw6-2xpx/GHSA-h5gm-rvw6-2xpx.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-f892-4h9f-j7g9\",\"aliases\":[\"CVE-2026-49877\"],\"commit\":\"https://github.com/github/advisory-database/commit/5aa7f472bdae2377252ee19acf255f7f176f8319\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/5aa7f472bdae2377252ee19acf255f7f176f8319/advisories/github-reviewed/2026/06/GHSA-f892-4h9f-j7g9/GHSA-f892-4h9f-j7g9.json\",\"id\":\"GHSA-f892-4h9f-j7g9\",\"packages\":[\"org.apache.activemq:apache-activemq\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-f892-4h9f-j7g9/GHSA-f892-4h9f-j7g9.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Apache ActiveMQ Improper Authorization vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-7259-vf48-52q3\",\"aliases\":[\"CVE-2026-50734\"],\"commit\":\"https://github.com/github/advisory-database/commit/cf4b010fd702de6801178a813c22567fde0e4908\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/cf4b010fd702de6801178a813c22567fde0e4908/advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json\",\"id\":\"GHSA-7259-vf48-52q3\",\"packages\":[\"org.apache.activemq:activemq-client\",\"org.apache.activemq:apache-activemq\",\"org.apache.activemq:activemq-all\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-9qj4-v6r6-3wmx\",\"aliases\":[\"CVE-2026-50750\"],\"commit\":\"https://github.com/github/advisory-database/commit/00388c49ed84e11fd7bbe4c533b00e6a96725296\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/00388c49ed84e11fd7bbe4c533b00e6a96725296/advisories/github-reviewed/2026/06/GHSA-9qj4-v6r6-3wmx/GHSA-9qj4-v6r6-3wmx.json\",\"id\":\"GHSA-9qj4-v6r6-3wmx\",\"packages\":[\"org.apache.activemq:activemq-broker\",\"org.apache.activemq:apache-activemq\",\"org.apache.activemq:activemq-all\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-9qj4-v6r6-3wmx/GHSA-9qj4-v6r6-3wmx.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-f77w-px59-cqf5\",\"aliases\":[\"CVE-2026-53917\"],\"commit\":\"https://github.com/github/advisory-database/commit/1fd15f5582aefdf9bd05012dedfa1cfb5f2589d3\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/1fd15f5582aefdf9bd05012dedfa1cfb5f2589d3/advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json\",\"id\":\"GHSA-f77w-px59-cqf5\",\"packages\":[\"org.apache.activemq:apache-activemq\",\"org.apache.activemq:activemq-all\",\"org.apache.activemq:activemq-client\",\"org.apache.activemq:activemq-broker\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-3cgg-c5pp-57h6\",\"aliases\":[\"CVE-2026-113787\"],\"commit\":\"https://github.com/github/advisory-database/commit/b5a44f78eb9999143bdf585014ce1ee95d3b1daf\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b5a44f78eb9999143bdf585014ce1ee95d3b1daf/advisories/github-reviewed/2026/11/GHSA-3cgg-c5pp-57h6/GHSA-3cgg-c5pp-57h6.json\",\"id\":\"GHSA-3cgg-c5pp-57h6\",\"packages\":[\"odf-kit\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-3cgg-c5pp-57h6/GHSA-3cgg-c5pp-57h6.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values\"},{\"advisory\":\"https://github.com/advisories/GHSA-5v3h-fjv2-54fg\",\"aliases\":[\"CVE-2026-55956\"],\"commit\":\"https://github.com/github/advisory-database/commit/0de2a17d38c440b5426a30a942fe87d5822155d0\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/0de2a17d38c440b5426a30a942fe87d5822155d0/advisories/github-reviewed/2026/06/GHSA-5v3h-fjv2-54fg/GHSA-5v3h-fjv2-54fg.json\",\"id\":\"GHSA-5v3h-fjv2-54fg\",\"packages\":[\"org.apache.tomcat.embed:tomcat-embed-core\",\"org.apache.tomcat:tomcat\",\"org.apache.tomcat:tomcat-catalina\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-5v3h-fjv2-54fg/GHSA-5v3h-fjv2-54fg.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Apache Tomcat has an Improper Authorization vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-7895-gffq-w6jq\",\"aliases\":[\"CVE-2026-55957\"],\"commit\":\"https://github.com/github/advisory-database/commit/476f281f70f359faf23a310a2a0c7dbe8c151834\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/476f281f70f359faf23a310a2a0c7dbe8c151834/advisories/github-reviewed/2026/06/GHSA-7895-gffq-w6jq/GHSA-7895-gffq-w6jq.json\",\"id\":\"GHSA-7895-gffq-w6jq\",\"packages\":[\"org.apache.tomcat.embed:tomcat-embed-core\",\"org.apache.tomcat:tomcat\",\"org.apache.tomcat:tomcat-catalina\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-7895-gffq-w6jq/GHSA-7895-gffq-w6jq.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Apache Tomcat has a Missing Critical Step in Authentication vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-c5ph-rghf-fjfj\",\"aliases\":[\"CVE-2026-55955\"],\"commit\":\"https://github.com/github/advisory-database/commit/abcaa04b68d39d803a109d26ba60fc420f042c61\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/abcaa04b68d39d803a109d26ba60fc420f042c61/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json\",\"id\":\"GHSA-c5ph-rghf-fjfj\",\"packages\":[\"org.apache.tomcat:tomcat\",\"org.apache.tomcat:tomcat-tribes\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Apache Tomcat has an Improper Authentication vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-mqg3-r7h5-24x4\",\"aliases\":[\"CVE-2026-55276\"],\"commit\":\"https://github.com/github/advisory-database/commit/e3708cb57e3aa264df797e3c9a17eee4fd6aa769\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/e3708cb57e3aa264df797e3c9a17eee4fd6aa769/advisories/github-reviewed/2026/06/GHSA-mqg3-r7h5-24x4/GHSA-mqg3-r7h5-24x4.json\",\"id\":\"GHSA-mqg3-r7h5-24x4\",\"packages\":[\"org.apache.tomcat.embed:tomcat-embed-core\",\"org.apache.tomcat:tomcat\",\"org.apache.tomcat:tomcat-util-scan\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-mqg3-r7h5-24x4/GHSA-mqg3-r7h5-24x4.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-h792-v28v-ppgr\",\"aliases\":[\"CVE-2026-53404\"],\"commit\":\"https://github.com/github/advisory-database/commit/0bb50231f88a9288477b136731f74619e41e0d6d\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/0bb50231f88a9288477b136731f74619e41e0d6d/advisories/github-reviewed/2026/06/GHSA-h792-v28v-ppgr/GHSA-h792-v28v-ppgr.json\",\"id\":\"GHSA-h792-v28v-ppgr\",\"packages\":[\"org.apache.tomcat.embed:tomcat-embed-core\",\"org.apache.tomcat:tomcat\",\"org.apache.tomcat:tomcat-catalina\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-h792-v28v-ppgr/GHSA-h792-v28v-ppgr.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability\"}],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 4, 2026, GitHub's security advisory list published 17 new advisories, changed 46, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "https://flarereef.flareforward.com/files/watch/0d8a3a45dccea10473d5af150a64019a8d4eb56063609241430aa676b5f08c26.json", "txHash": "0x9f84d74c87edc6feb1afed0ff39a04adeef724ed201af0d9a9fe527a3c31a1c3", "receiptUrl": "https://flare-explorer.flare.network/tx/0x9f84d74c87edc6feb1afed0ff39a04adeef724ed201af0d9a9fe527a3c31a1c3", "blockNumber": 73770395, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": [], "parsed": {"counts": {"changed": 46, "published": 17, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-04", "kind": "watch-day", "recordedAt": "2026-11-05T02:02:47Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-7p85-w9px-jpjp", "aliases": ["CVE-2026-46633"], "commit": "https://github.com/github/advisory-database/commit/8d8209a50cacdad85184e017ac9d9cec92b4e0cb", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/8d8209a50cacdad85184e017ac9d9cec92b4e0cb/advisories/github-reviewed/2026/05/GHSA-7p85-w9px-jpjp/GHSA-7p85-w9px-jpjp.json", "id": "GHSA-7p85-w9px-jpjp", "packages": ["twig/twig"], "path": "advisories/github-reviewed/2026/05/GHSA-7p85-w9px-jpjp/GHSA-7p85-w9px-jpjp.json", "severity": "CRITICAL", "status": "changed", "summary": "Twig: PHP code injection via `{% use %}` template name"}, {"advisory": "https://github.com/advisories/GHSA-659w-93r5-9j6m", "aliases": ["CVE-2026-42440"], "commit": "https://github.com/github/advisory-database/commit/d29f93b34c304df05cd3a23ea898c61ebb69d2ea", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/d29f93b34c304df05cd3a23ea898c61ebb69d2ea/advisories/github-reviewed/2026/05/GHSA-659w-93r5-9j6m/GHSA-659w-93r5-9j6m.json", "id": "GHSA-659w-93r5-9j6m", "packages": ["org.apache.opennlp:opennlp-tools"], "path": "advisories/github-reviewed/2026/05/GHSA-659w-93r5-9j6m/GHSA-659w-93r5-9j6m.json", "severity": "HIGH", "status": "changed", "summary": "Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation"}, {"advisory": "https://github.com/advisories/GHSA-63cw-57p8-fm3p", "aliases": ["CVE-2026-24747"], "commit": "https://github.com/github/advisory-database/commit/568487bb4bb7928f51234182640bce237067a8c9", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/568487bb4bb7928f51234182640bce237067a8c9/advisories/github-reviewed/2026/01/GHSA-63cw-57p8-fm3p/GHSA-63cw-57p8-fm3p.json", "id": "GHSA-63cw-57p8-fm3p", "packages": ["torch"], "path": "advisories/github-reviewed/2026/01/GHSA-63cw-57p8-fm3p/GHSA-63cw-57p8-fm3p.json", "severity": "HIGH", "status": "changed", "summary": "PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files"}, {"advisory": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg", "aliases": ["CVE-2025-13465"], "commit": "https://github.com/github/advisory-database/commit/378cd3bf07dd1a59610cd65c576008e5b586979f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/378cd3bf07dd1a59610cd65c576008e5b586979f/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json", "id": "GHSA-xxjr-mmjv-4gpg", "packages": ["lodash", "lodash-amd", "lodash-es", "lodash.omit", "lodash.unset"], "path": "advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json", "severity": "MODERATE", "status": "changed", "summary": "Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions"}, {"advisory": "https://github.com/advisories/GHSA-mgp5-rv84-w37q", "aliases": ["CVE-2026-24734"], "commit": "https://github.com/github/advisory-database/commit/5f5b41b00513c7ce1e843053d1d22999dafca0b0", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/5f5b41b00513c7ce1e843053d1d22999dafca0b0/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json", "id": "GHSA-mgp5-rv84-w37q", "packages": ["org.apache.tomcat:tomcat-coyote", "org.apache.tomcat.embed:tomcat-embed-core", "org.apache.tomcat:tomcat-coyote-ffm"], "path": "advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json", "severity": "HIGH", "status": "changed", "summary": "Apache Tomcat has an Improper Input Validation vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-68j8-pq59-fqgm", "aliases": ["CVE-2026-0847"], "commit": "https://github.com/github/advisory-database/commit/5f5b41b00513c7ce1e843053d1d22999dafca0b0", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/5f5b41b00513c7ce1e843053d1d22999dafca0b0/advisories/github-reviewed/2026/03/GHSA-68j8-pq59-fqgm/GHSA-68j8-pq59-fqgm.json", "id": "GHSA-68j8-pq59-fqgm", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/03/GHSA-68j8-pq59-fqgm/GHSA-68j8-pq59-fqgm.json", "severity": "HIGH", "status": "changed", "summary": "NLTK has a Path Traversal issue"}, {"advisory": "https://github.com/advisories/GHSA-3r9x-f23j-gc73", "aliases": ["CVE-2026-27489"], "commit": "https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/03/GHSA-3r9x-f23j-gc73/GHSA-3r9x-f23j-gc73.json", "id": "GHSA-3r9x-f23j-gc73", "packages": ["onnx"], "path": "advisories/github-reviewed/2026/03/GHSA-3r9x-f23j-gc73/GHSA-3r9x-f23j-gc73.json", "severity": "HIGH", "status": "changed", "summary": "onnx Vulnerable to Path Traversal via Symlink"}, {"advisory": "https://github.com/advisories/GHSA-469j-vmhf-r6v7", "aliases": ["CVE-2026-33236"], "commit": "https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/03/GHSA-469j-vmhf-r6v7/GHSA-469j-vmhf-r6v7.json", "id": "GHSA-469j-vmhf-r6v7", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/03/GHSA-469j-vmhf-r6v7/GHSA-469j-vmhf-r6v7.json", "severity": "HIGH", "status": "changed", "summary": "NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite"}, {"advisory": "https://github.com/advisories/GHSA-qr99-7898-vr7c", "aliases": ["CVE-2026-33433"], "commit": "https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/03/GHSA-qr99-7898-vr7c/GHSA-qr99-7898-vr7c.json", "id": "GHSA-qr99-7898-vr7c", "packages": ["github.com/traefik/traefik/v2", "github.com/traefik/traefik/v3"], "path": "advisories/github-reviewed/2026/03/GHSA-qr99-7898-vr7c/GHSA-qr99-7898-vr7c.json", "severity": "MODERATE", "status": "changed", "summary": "Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField"}, {"advisory": "https://github.com/advisories/GHSA-p423-j2cm-9vmq", "aliases": ["CVE-2026-39892"], "commit": "https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/04/GHSA-p423-j2cm-9vmq/GHSA-p423-j2cm-9vmq.json", "id": "GHSA-p423-j2cm-9vmq", "packages": ["cryptography"], "path": "advisories/github-reviewed/2026/04/GHSA-p423-j2cm-9vmq/GHSA-p423-j2cm-9vmq.json", "severity": "MODERATE", "status": "changed", "summary": "Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs"}, {"advisory": "https://github.com/advisories/GHSA-p93r-85wp-75v3", "aliases": ["CVE-2026-5598"], "commit": "https://github.com/github/advisory-database/commit/fd0f6e20b23c4d395ac90a0f97fe2f4fad2b1cd3", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/fd0f6e20b23c4d395ac90a0f97fe2f4fad2b1cd3/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json", "id": "GHSA-p93r-85wp-75v3", "packages": ["org.bouncycastle:bcprov-jdk15to18", "org.bouncycastle:bcprov-jdk14", "org.bouncycastle:bcprov-jdk18on"], "path": "advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json", "severity": "HIGH", "status": "changed", "summary": "Bouncy Castle Has Covert Timing Channel Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-c3fc-8qff-9hwx", "aliases": ["CVE-2026-0636"], "commit": "https://github.com/github/advisory-database/commit/257898fe95916c61b45527df993e2f2fa485bf94", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/257898fe95916c61b45527df993e2f2fa485bf94/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json", "id": "GHSA-c3fc-8qff-9hwx", "packages": ["org.bouncycastle:bcprov-jdk14", "org.bouncycastle:bcprov-jdk15to18", "org.bouncycastle:bcprov-jdk18on"], "path": "advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json", "severity": "MODERATE", "status": "changed", "summary": "Bouncy Castle has an LDAP injection"}, {"advisory": "https://github.com/advisories/GHSA-v3vg-332r-mw99", "aliases": ["CVE-2026-40048"], "commit": "https://github.com/github/advisory-database/commit/c838fdf54fffc232e4559792eb1b1b915d5b0d60", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/c838fdf54fffc232e4559792eb1b1b915d5b0d60/advisories/github-reviewed/2026/04/GHSA-v3vg-332r-mw99/GHSA-v3vg-332r-mw99.json", "id": "GHSA-v3vg-332r-mw99", "packages": ["org.apache.camel:camel-pqc"], "path": "advisories/github-reviewed/2026/04/GHSA-v3vg-332r-mw99/GHSA-v3vg-332r-mw99.json", "severity": "HIGH", "status": "changed", "summary": "Camel-PQC Vulnerable to Deserialization of Untrusted Data"}, {"advisory": "https://github.com/advisories/GHSA-26hh-7cqf-hhc6", "aliases": ["CVE-2026-45109"], "commit": "https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-26hh-7cqf-hhc6/GHSA-26hh-7cqf-hhc6.json", "id": "GHSA-26hh-7cqf-hhc6", "packages": ["next"], "path": "advisories/github-reviewed/2026/05/GHSA-26hh-7cqf-hhc6/GHSA-26hh-7cqf-hhc6.json", "severity": "HIGH", "status": "changed", "summary": "Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up"}, {"advisory": "https://github.com/advisories/GHSA-55hx-c926-fr95", "aliases": ["CVE-2026-26332"], "commit": "https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-55hx-c926-fr95/GHSA-55hx-c926-fr95.json", "id": "GHSA-55hx-c926-fr95", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-55hx-c926-fr95/GHSA-55hx-c926-fr95.json", "severity": "CRITICAL", "status": "changed", "summary": "VM2 Has a Sandbox Escape Issue via SuppressedError"}, {"advisory": "https://github.com/advisories/GHSA-grj5-jjm8-h35p", "aliases": ["CVE-2026-24118"], "commit": "https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-grj5-jjm8-h35p/GHSA-grj5-jjm8-h35p.json", "id": "GHSA-grj5-jjm8-h35p", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-grj5-jjm8-h35p/GHSA-grj5-jjm8-h35p.json", "severity": "CRITICAL", "status": "changed", "summary": "VM2 Sandbox Breakout Through __lookupGetter__"}, {"advisory": "https://github.com/advisories/GHSA-v37h-5mfm-c47c", "aliases": ["CVE-2026-24781"], "commit": "https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-v37h-5mfm-c47c/GHSA-v37h-5mfm-c47c.json", "id": "GHSA-v37h-5mfm-c47c", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-v37h-5mfm-c47c/GHSA-v37h-5mfm-c47c.json", "severity": "CRITICAL", "status": "changed", "summary": "VM2 Has Sandbox Breakout Through Inspect Function"}, {"advisory": "https://github.com/advisories/GHSA-8hg8-63c5-gwmx", "aliases": ["CVE-2026-44007"], "commit": "https://github.com/github/advisory-database/commit/f5a2d1ff6e7b5791366faa2b74615534a1a1462e", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/f5a2d1ff6e7b5791366faa2b74615534a1a1462e/advisories/github-reviewed/2026/05/GHSA-8hg8-63c5-gwmx/GHSA-8hg8-63c5-gwmx.json", "id": "GHSA-8hg8-63c5-gwmx", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-8hg8-63c5-gwmx/GHSA-8hg8-63c5-gwmx.json", "severity": "CRITICAL", "status": "changed", "summary": "vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution"}, {"advisory": "https://github.com/advisories/GHSA-9qj6-qjgg-37qq", "aliases": ["CVE-2026-44008"], "commit": "https://github.com/github/advisory-database/commit/f5a2d1ff6e7b5791366faa2b74615534a1a1462e", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/f5a2d1ff6e7b5791366faa2b74615534a1a1462e/advisories/github-reviewed/2026/05/GHSA-9qj6-qjgg-37qq/GHSA-9qj6-qjgg-37qq.json", "id": "GHSA-9qj6-qjgg-37qq", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-9qj6-qjgg-37qq/GHSA-9qj6-qjgg-37qq.json", "severity": "CRITICAL", "status": "changed", "summary": "vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`"}, {"advisory": "https://github.com/advisories/GHSA-9vg3-4rfj-wgcm", "aliases": ["CVE-2026-44009"], "commit": "https://github.com/github/advisory-database/commit/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f/advisories/github-reviewed/2026/05/GHSA-9vg3-4rfj-wgcm/GHSA-9vg3-4rfj-wgcm.json", "id": "GHSA-9vg3-4rfj-wgcm", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-9vg3-4rfj-wgcm/GHSA-9vg3-4rfj-wgcm.json", "severity": "CRITICAL", "status": "changed", "summary": "vm2 has Sandbox Breakout Through Null Proto Exception"}, {"advisory": "https://github.com/advisories/GHSA-vxpw-j846-p89q", "aliases": ["CVE-2026-12151"], "commit": "https://github.com/github/advisory-database/commit/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f/advisories/github-reviewed/2026/06/GHSA-vxpw-j846-p89q/GHSA-vxpw-j846-p89q.json", "id": "GHSA-vxpw-j846-p89q", "packages": ["undici"], "path": "advisories/github-reviewed/2026/06/GHSA-vxpw-j846-p89q/GHSA-vxpw-j846-p89q.json", "severity": "HIGH", "status": "changed", "summary": "undici WebSocket client vulnerable to denial of service via fragment count bypass"}, {"advisory": "https://github.com/advisories/GHSA-wp3c-266w-4qfq", "aliases": ["CVE-2026-49293"], "commit": "https://github.com/github/advisory-database/commit/557871daae102762572edbc32c842a7a1a46113a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/557871daae102762572edbc32c842a7a1a46113a/advisories/github-reviewed/2026/06/GHSA-wp3c-266w-4qfq/GHSA-wp3c-266w-4qfq.json", "id": "GHSA-wp3c-266w-4qfq", "packages": ["js-toml"], "path": "advisories/github-reviewed/2026/06/GHSA-wp3c-266w-4qfq/GHSA-wp3c-266w-4qfq.json", "severity": "HIGH", "status": "changed", "summary": "js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals"}, {"advisory": "https://github.com/advisories/GHSA-3fxj-6jh8-hvhx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/9476a7ac3483db5eb8a2acf162787ffc27bebd6c", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/9476a7ac3483db5eb8a2acf162787ffc27bebd6c/advisories/github-reviewed/2026/06/GHSA-3fxj-6jh8-hvhx/GHSA-3fxj-6jh8-hvhx.json", "id": "GHSA-3fxj-6jh8-hvhx", "packages": ["github.com/go-chi/chi/v5/middleware", "github.com/go-chi/chi/v5"], "path": "advisories/github-reviewed/2026/06/GHSA-3fxj-6jh8-hvhx/GHSA-3fxj-6jh8-hvhx.json", "severity": "MODERATE", "status": "changed", "summary": "chi Has an IP Spoofing Vulnerability in `middleware.RealIP`"}, {"advisory": "https://github.com/advisories/GHSA-rp2p-6cmp-jxj9", "aliases": ["CVE-2026-57108"], "commit": "https://github.com/github/advisory-database/commit/3c82703bb98b8d802b37a346686bdc5a605056a2", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/3c82703bb98b8d802b37a346686bdc5a605056a2/advisories/github-reviewed/2026/07/GHSA-rp2p-6cmp-jxj9/GHSA-rp2p-6cmp-jxj9.json", "id": "GHSA-rp2p-6cmp-jxj9", "packages": ["Microsoft.NetCore.App.Runtime.linux-arm", "Microsoft.NetCore.App.Runtime.linux-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-arm", "Microsoft.NetCore.App.Runtime.linux-musl-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-x64", "Microsoft.NetCore.App.Runtime.linux-x64", "Microsoft.NetCore.App.Runtime.osx-arm64", "Microsoft.NetCore.App.Runtime.osx-x64"], "path": "advisories/github-reviewed/2026/07/GHSA-rp2p-6cmp-jxj9/GHSA-rp2p-6cmp-jxj9.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-57108 \u2013 .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-2969-4q4w-w5h3", "aliases": ["CVE-2026-50650"], "commit": "https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/07/GHSA-2969-4q4w-w5h3/GHSA-2969-4q4w-w5h3.json", "id": "GHSA-2969-4q4w-w5h3", "packages": ["Microsoft.WindowsDesktop.App.Runtime.win-x64", "Microsoft.WindowsDesktop.App.Runtime.win-x86", "Microsoft.WindowsDesktop.App.Runtime.win-arm64"], "path": "advisories/github-reviewed/2026/07/GHSA-2969-4q4w-w5h3/GHSA-2969-4q4w-w5h3.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-50650 \u2013 .NET Elevation of Privilege Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-w7cw-xp7h-6j5j", "aliases": ["CVE-2026-50524"], "commit": "https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/07/GHSA-w7cw-xp7h-6j5j/GHSA-w7cw-xp7h-6j5j.json", "id": "GHSA-w7cw-xp7h-6j5j", "packages": ["Microsoft.NetCore.App.Runtime.linux-arm", "Microsoft.NetCore.App.Runtime.linux-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-arm", "Microsoft.NetCore.App.Runtime.linux-musl-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-x64", "Microsoft.NetCore.App.Runtime.linux-x64", "Microsoft.NetCore.App.Runtime.osx-arm64", "Microsoft.NetCore.App.Runtime.osx-x64", "Microsoft.NetCore.App.Runtime.win-arm", "Microsoft.NetCore.App.Runtime.win-arm64", "Microsoft.NetCore.App.Runtime.win-x64", "Microsoft.NetCore.App.Runtime.win-x86"], "path": "advisories/github-reviewed/2026/07/GHSA-w7cw-xp7h-6j5j/GHSA-w7cw-xp7h-6j5j.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-50524 \u2013 .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-wp74-jgxh-gv4q", "aliases": ["CVE-2026-50651"], "commit": "https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/07/GHSA-wp74-jgxh-gv4q/GHSA-wp74-jgxh-gv4q.json", "id": "GHSA-wp74-jgxh-gv4q", "packages": ["Microsoft.NetCore.App.Runtime.linux-arm", "Microsoft.NetCore.App.Runtime.linux-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-arm", "Microsoft.NetCore.App.Runtime.linux-musl-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-x64", "Microsoft.NetCore.App.Runtime.linux-x64", "Microsoft.NetCore.App.Runtime.osx-arm64", "Microsoft.NetCore.App.Runtime.osx-x64", "Microsoft.NetCore.App.Runtime.win-arm", "Microsoft.NetCore.App.Runtime.win-arm64", "Microsoft.NetCore.App.Runtime.win-x64", "Microsoft.NetCore.App.Runtime.win-x86"], "path": "advisories/github-reviewed/2026/07/GHSA-wp74-jgxh-gv4q/GHSA-wp74-jgxh-gv4q.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-50651 \u2013 .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-2j8r-3c22-8565", "aliases": ["CVE-2026-69522"], "commit": "https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/09/GHSA-2j8r-3c22-8565/GHSA-2j8r-3c22-8565.json", "id": "GHSA-2j8r-3c22-8565", "packages": ["Microsoft.DiaSymReader.Native"], "path": "advisories/github-reviewed/2026/09/GHSA-2j8r-3c22-8565/GHSA-2j8r-3c22-8565.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-69522 \u2013 .NET and Visual Studio Remote Code Execution Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-v653-r55g-hcmg", "aliases": ["CVE-2025-13327"], "commit": "https://github.com/github/advisory-database/commit/7b9d4a76d57210c31547ee6aa9a88f906d4211f0", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/7b9d4a76d57210c31547ee6aa9a88f906d4211f0/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "id": "GHSA-v653-r55g-hcmg", "packages": ["uv"], "path": "advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "severity": "MODERATE", "status": "changed", "summary": "uv has ZIP payload obfuscation through parsing differentials"}, {"advisory": "https://github.com/advisories/GHSA-h5gm-rvw6-2xpx", "aliases": ["CVE-2026-49434"], "commit": "https://github.com/github/advisory-database/commit/9d0e960825d8c8d78f6c45f2a23b9a641a0fcd94", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/9d0e960825d8c8d78f6c45f2a23b9a641a0fcd94/advisories/github-reviewed/2026/06/GHSA-h5gm-rvw6-2xpx/GHSA-h5gm-rvw6-2xpx.json", "id": "GHSA-h5gm-rvw6-2xpx", "packages": ["org.apache.activemq:activemq-broker", "org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-all"], "path": "advisories/github-reviewed/2026/06/GHSA-h5gm-rvw6-2xpx/GHSA-h5gm-rvw6-2xpx.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-f892-4h9f-j7g9", "aliases": ["CVE-2026-49877"], "commit": "https://github.com/github/advisory-database/commit/5aa7f472bdae2377252ee19acf255f7f176f8319", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/5aa7f472bdae2377252ee19acf255f7f176f8319/advisories/github-reviewed/2026/06/GHSA-f892-4h9f-j7g9/GHSA-f892-4h9f-j7g9.json", "id": "GHSA-f892-4h9f-j7g9", "packages": ["org.apache.activemq:apache-activemq"], "path": "advisories/github-reviewed/2026/06/GHSA-f892-4h9f-j7g9/GHSA-f892-4h9f-j7g9.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ Improper Authorization vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-7259-vf48-52q3", "aliases": ["CVE-2026-50734"], "commit": "https://github.com/github/advisory-database/commit/cf4b010fd702de6801178a813c22567fde0e4908", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/cf4b010fd702de6801178a813c22567fde0e4908/advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json", "id": "GHSA-7259-vf48-52q3", "packages": ["org.apache.activemq:activemq-client", "org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-all"], "path": "advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-9qj4-v6r6-3wmx", "aliases": ["CVE-2026-50750"], "commit": "https://github.com/github/advisory-database/commit/00388c49ed84e11fd7bbe4c533b00e6a96725296", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/00388c49ed84e11fd7bbe4c533b00e6a96725296/advisories/github-reviewed/2026/06/GHSA-9qj4-v6r6-3wmx/GHSA-9qj4-v6r6-3wmx.json", "id": "GHSA-9qj4-v6r6-3wmx", "packages": ["org.apache.activemq:activemq-broker", "org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-all"], "path": "advisories/github-reviewed/2026/06/GHSA-9qj4-v6r6-3wmx/GHSA-9qj4-v6r6-3wmx.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-f77w-px59-cqf5", "aliases": ["CVE-2026-53917"], "commit": "https://github.com/github/advisory-database/commit/1fd15f5582aefdf9bd05012dedfa1cfb5f2589d3", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/1fd15f5582aefdf9bd05012dedfa1cfb5f2589d3/advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json", "id": "GHSA-f77w-px59-cqf5", "packages": ["org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-all", "org.apache.activemq:activemq-client", "org.apache.activemq:activemq-broker"], "path": "advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-3cgg-c5pp-57h6", "aliases": ["CVE-2026-113787"], "commit": "https://github.com/github/advisory-database/commit/b5a44f78eb9999143bdf585014ce1ee95d3b1daf", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b5a44f78eb9999143bdf585014ce1ee95d3b1daf/advisories/github-reviewed/2026/11/GHSA-3cgg-c5pp-57h6/GHSA-3cgg-c5pp-57h6.json", "id": "GHSA-3cgg-c5pp-57h6", "packages": ["odf-kit"], "path": "advisories/github-reviewed/2026/11/GHSA-3cgg-c5pp-57h6/GHSA-3cgg-c5pp-57h6.json", "severity": "MODERATE", "status": "published", "summary": "odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values"}, {"advisory": "https://github.com/advisories/GHSA-5v3h-fjv2-54fg", "aliases": ["CVE-2026-55956"], "commit": "https://github.com/github/advisory-database/commit/0de2a17d38c440b5426a30a942fe87d5822155d0", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/0de2a17d38c440b5426a30a942fe87d5822155d0/advisories/github-reviewed/2026/06/GHSA-5v3h-fjv2-54fg/GHSA-5v3h-fjv2-54fg.json", "id": "GHSA-5v3h-fjv2-54fg", "packages": ["org.apache.tomcat.embed:tomcat-embed-core", "org.apache.tomcat:tomcat", "org.apache.tomcat:tomcat-catalina"], "path": "advisories/github-reviewed/2026/06/GHSA-5v3h-fjv2-54fg/GHSA-5v3h-fjv2-54fg.json", "severity": "MODERATE", "status": "published", "summary": "Apache Tomcat has an Improper Authorization vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-7895-gffq-w6jq", "aliases": ["CVE-2026-55957"], "commit": "https://github.com/github/advisory-database/commit/476f281f70f359faf23a310a2a0c7dbe8c151834", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/476f281f70f359faf23a310a2a0c7dbe8c151834/advisories/github-reviewed/2026/06/GHSA-7895-gffq-w6jq/GHSA-7895-gffq-w6jq.json", "id": "GHSA-7895-gffq-w6jq", "packages": ["org.apache.tomcat.embed:tomcat-embed-core", "org.apache.tomcat:tomcat", "org.apache.tomcat:tomcat-catalina"], "path": "advisories/github-reviewed/2026/06/GHSA-7895-gffq-w6jq/GHSA-7895-gffq-w6jq.json", "severity": "HIGH", "status": "published", "summary": "Apache Tomcat has a Missing Critical Step in Authentication vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-c5ph-rghf-fjfj", "aliases": ["CVE-2026-55955"], "commit": "https://github.com/github/advisory-database/commit/abcaa04b68d39d803a109d26ba60fc420f042c61", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/abcaa04b68d39d803a109d26ba60fc420f042c61/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json", "id": "GHSA-c5ph-rghf-fjfj", "packages": ["org.apache.tomcat:tomcat", "org.apache.tomcat:tomcat-tribes"], "path": "advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json", "severity": "MODERATE", "status": "published", "summary": "Apache Tomcat has an Improper Authentication vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-mqg3-r7h5-24x4", "aliases": ["CVE-2026-55276"], "commit": "https://github.com/github/advisory-database/commit/e3708cb57e3aa264df797e3c9a17eee4fd6aa769", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/e3708cb57e3aa264df797e3c9a17eee4fd6aa769/advisories/github-reviewed/2026/06/GHSA-mqg3-r7h5-24x4/GHSA-mqg3-r7h5-24x4.json", "id": "GHSA-mqg3-r7h5-24x4", "packages": ["org.apache.tomcat.embed:tomcat-embed-core", "org.apache.tomcat:tomcat", "org.apache.tomcat:tomcat-util-scan"], "path": "advisories/github-reviewed/2026/06/GHSA-mqg3-r7h5-24x4/GHSA-mqg3-r7h5-24x4.json", "severity": "CRITICAL", "status": "published", "summary": "Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-h792-v28v-ppgr", "aliases": ["CVE-2026-53404"], "commit": "https://github.com/github/advisory-database/commit/0bb50231f88a9288477b136731f74619e41e0d6d", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/0bb50231f88a9288477b136731f74619e41e0d6d/advisories/github-reviewed/2026/06/GHSA-h792-v28v-ppgr/GHSA-h792-v28v-ppgr.json", "id": "GHSA-h792-v28v-ppgr", "packages": ["org.apache.tomcat.embed:tomcat-embed-core", "org.apache.tomcat:tomcat", "org.apache.tomcat:tomcat-catalina"], "path": "advisories/github-reviewed/2026/06/GHSA-h792-v28v-ppgr/GHSA-h792-v28v-ppgr.json", "severity": "HIGH", "status": "published", "summary": "Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-pg42-rg8c-j886", "aliases": ["CVE-2026-50229"], "commit": "https://github.com/github/advisory-database/commit/d5e5c5ec0c1a386d1245ffefe8f044e5f5d5d936", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/d5e5c5ec0c1a386d1245ffefe8f044e5f5d5d936/advisories/github-reviewed/2026/06/GHSA-pg42-rg8c-j886/GHSA-pg42-rg8c-j886.json", "id": "GHSA-pg42-rg8c-j886", "packages": ["org.apache.tomcat:tomcat"], "path": "advisories/github-reviewed/2026/06/GHSA-pg42-rg8c-j886/GHSA-pg42-rg8c-j886.json", "severity": "MODERATE", "status": "published", "summary": "Apache Tomcat has a Cross-site Scripting vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "aliases": ["CVE-2026-118764"], "commit": "https://github.com/github/advisory-database/commit/db6b565eb01ac6a316283ef3d177ce76b587c7d0", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/db6b565eb01ac6a316283ef3d177ce76b587c7d0/advisories/github-reviewed/2026/10/GHSA-g3hv-75wg-m249/GHSA-g3hv-75wg-m249.json", "id": "GHSA-g3hv-75wg-m249", "packages": ["minimatch"], "path": "advisories/github-reviewed/2026/10/GHSA-g3hv-75wg-m249/GHSA-g3hv-75wg-m249.json", "severity": "MODERATE", "status": "changed", "summary": "minimatch has potential denial of service via globparts amplification"}, {"advisory": "https://github.com/advisories/GHSA-mc8m-rr6c-r5qr", "aliases": ["CVE-2026-93363"], "commit": "https://github.com/github/advisory-database/commit/8320eee3cbf9f6001f2acc857e0390efd2d75710", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/8320eee3cbf9f6001f2acc857e0390efd2d75710/advisories/github-reviewed/2026/11/GHSA-mc8m-rr6c-r5qr/GHSA-mc8m-rr6c-r5qr.json", "id": "GHSA-mc8m-rr6c-r5qr", "packages": ["@payloadcms/storage-vercel-blob"], "path": "advisories/github-reviewed/2026/11/GHSA-mc8m-rr6c-r5qr/GHSA-mc8m-rr6c-r5qr.json", "severity": "MODERATE", "status": "published", "summary": "@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter"}, {"advisory": "https://github.com/advisories/GHSA-93cm-2v4m-c56c", "aliases": ["CVE-2026-55098"], "commit": "https://github.com/github/advisory-database/commit/fcd0d8752081d5aaef409e634881b062cadd651c", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/fcd0d8752081d5aaef409e634881b062cadd651c/advisories/github-reviewed/2026/11/GHSA-93cm-2v4m-c56c/GHSA-93cm-2v4m-c56c.json", "id": "GHSA-93cm-2v4m-c56c", "packages": ["github.com/basekick-labs/arc"], "path": "advisories/github-reviewed/2026/11/GHSA-93cm-2v4m-c56c/GHSA-93cm-2v4m-c56c.json", "severity": "MODERATE", "status": "published", "summary": "Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735"}, {"advisory": "https://github.com/advisories/GHSA-xq3m-2v4x-88gg", "aliases": ["CVE-2026-41242"], "commit": "https://github.com/github/advisory-database/commit/767f96481e4e169de400e47608b0e550af6ad319", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/767f96481e4e169de400e47608b0e550af6ad319/advisories/github-reviewed/2026/04/GHSA-xq3m-2v4x-88gg/GHSA-xq3m-2v4x-88gg.json", "id": "GHSA-xq3m-2v4x-88gg", "packages": ["protobufjs"], "path": "advisories/github-reviewed/2026/04/GHSA-xq3m-2v4x-88gg/GHSA-xq3m-2v4x-88gg.json", "severity": "CRITICAL", "status": "changed", "summary": "protobufjs has an arbitrary code execution issue"}, {"advisory": "https://github.com/advisories/GHSA-6f2p-2qg2-qqch", "aliases": ["CVE-2026-13322"], "commit": "https://github.com/github/advisory-database/commit/64f29619e3facde666a5656253caba04a35f598a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/64f29619e3facde666a5656253caba04a35f598a/advisories/github-reviewed/2026/06/GHSA-6f2p-2qg2-qqch/GHSA-6f2p-2qg2-qqch.json", "id": "GHSA-6f2p-2qg2-qqch", "packages": ["github.com/kubevirt/kubevirt"], "path": "advisories/github-reviewed/2026/06/GHSA-6f2p-2qg2-qqch/GHSA-6f2p-2qg2-qqch.json", "severity": "LOW", "status": "changed", "summary": "KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption"}, {"advisory": "https://github.com/advisories/GHSA-cgm6-wvp9-4g5h", "aliases": ["CVE-2026-13318"], "commit": "https://github.com/github/advisory-database/commit/64f29619e3facde666a5656253caba04a35f598a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/64f29619e3facde666a5656253caba04a35f598a/advisories/github-reviewed/2026/06/GHSA-cgm6-wvp9-4g5h/GHSA-cgm6-wvp9-4g5h.json", "id": "GHSA-cgm6-wvp9-4g5h", "packages": ["kubevirt.io/kubevirt"], "path": "advisories/github-reviewed/2026/06/GHSA-cgm6-wvp9-4g5h/GHSA-cgm6-wvp9-4g5h.json", "severity": "MODERATE", "status": "changed", "summary": "KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address"}, {"advisory": "https://github.com/advisories/GHSA-q3jc-42cq-33fj", "aliases": ["CVE-2026-13218"], "commit": "https://github.com/github/advisory-database/commit/495a5678d0934a9fc2047202e2999a981b261e4c", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/495a5678d0934a9fc2047202e2999a981b261e4c/advisories/github-reviewed/2026/06/GHSA-q3jc-42cq-33fj/GHSA-q3jc-42cq-33fj.json", "id": "GHSA-q3jc-42cq-33fj", "packages": ["kubevirt.io/kubevirt"], "path": "advisories/github-reviewed/2026/06/GHSA-q3jc-42cq-33fj/GHSA-q3jc-42cq-33fj.json", "severity": "MODERATE", "status": "changed", "summary": "KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite"}, {"advisory": "https://github.com/advisories/GHSA-7g64-f2hm-vjxp", "aliases": ["CVE-2026-12975"], "commit": "https://github.com/github/advisory-database/commit/c17d5cb32d992acd951c598ed4d9a2a0679fd180", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/c17d5cb32d992acd951c598ed4d9a2a0679fd180/advisories/github-reviewed/2026/06/GHSA-7g64-f2hm-vjxp/GHSA-7g64-f2hm-vjxp.json", "id": "GHSA-7g64-f2hm-vjxp", "packages": ["io.apicurio:apicurio-registry-schema-util-common"], "path": "advisories/github-reviewed/2026/06/GHSA-7g64-f2hm-vjxp/GHSA-7g64-f2hm-vjxp.json", "severity": "HIGH", "status": "published", "summary": "Apicurio Registry utilities allow SSRF and denial of service through XML parsing"}, {"advisory": "https://github.com/advisories/GHSA-rcmh-vfq7-8gf4", "aliases": ["CVE-2026-12992"], "commit": "https://github.com/github/advisory-database/commit/fd60a4de4b7272f2342c6b37dd2a4778f722a899", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/fd60a4de4b7272f2342c6b37dd2a4778f722a899/advisories/github-reviewed/2026/06/GHSA-rcmh-vfq7-8gf4/GHSA-rcmh-vfq7-8gf4.json", "id": "GHSA-rcmh-vfq7-8gf4", "packages": ["io.apicurio:apicurio-registry-schema-util-wsdl"], "path": "advisories/github-reviewed/2026/06/GHSA-rcmh-vfq7-8gf4/GHSA-rcmh-vfq7-8gf4.json", "severity": "HIGH", "status": "published", "summary": "Apicurio Registry allows upload of WSDL raising HTTP request "}, {"advisory": "https://github.com/advisories/GHSA-748j-wm96-4wh5", "aliases": ["CVE-2026-12993"], "commit": "https://github.com/github/advisory-database/commit/53298e035bd2729cafe5a51d768fd8a32d7cbb17", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/53298e035bd2729cafe5a51d768fd8a32d7cbb17/advisories/github-reviewed/2026/06/GHSA-748j-wm96-4wh5/GHSA-748j-wm96-4wh5.json", "id": "GHSA-748j-wm96-4wh5", "packages": ["io.apicurio:apicurio-registry-schema-util-xml"], "path": "advisories/github-reviewed/2026/06/GHSA-748j-wm96-4wh5/GHSA-748j-wm96-4wh5.json", "severity": "MODERATE", "status": "published", "summary": "Apicurio Registry is vulnerable to denial of service through XML entity expansion"}, {"advisory": "https://github.com/advisories/GHSA-vqqj-9cmv-hx43", "aliases": ["CVE-2026-28369"], "commit": "https://github.com/github/advisory-database/commit/7a766ee5a5ba897bab2181e56b8275e9cfb2349c", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/7a766ee5a5ba897bab2181e56b8275e9cfb2349c/advisories/github-reviewed/2026/03/GHSA-vqqj-9cmv-hx43/GHSA-vqqj-9cmv-hx43.json", "id": "GHSA-vqqj-9cmv-hx43", "packages": ["io.undertow:undertow-core"], "path": "advisories/github-reviewed/2026/03/GHSA-vqqj-9cmv-hx43/GHSA-vqqj-9cmv-hx43.json", "severity": "HIGH", "status": "changed", "summary": "Undertow is Vulnerable to HTTP Request/Response Smuggling"}, {"advisory": "https://github.com/advisories/GHSA-3gv6-g396-9v4r", "aliases": ["CVE-2026-28367"], "commit": "https://github.com/github/advisory-database/commit/5dba8c957620db8b87373c076694d087e15d7904", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/5dba8c957620db8b87373c076694d087e15d7904/advisories/github-reviewed/2026/03/GHSA-3gv6-g396-9v4r/GHSA-3gv6-g396-9v4r.json", "id": "GHSA-3gv6-g396-9v4r", "packages": ["io.undertow:undertow-core"], "path": "advisories/github-reviewed/2026/03/GHSA-3gv6-g396-9v4r/GHSA-3gv6-g396-9v4r.json", "severity": "HIGH", "status": "changed", "summary": "Undertow is Vulnerable to HTTP Request/Response Smuggling"}, {"advisory": "https://github.com/advisories/GHSA-8v4x-mgvp-p658", "aliases": ["CVE-2026-28368"], "commit": "https://github.com/github/advisory-database/commit/022d1a3e3c163d8ffc76af65f25890766077c527", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/022d1a3e3c163d8ffc76af65f25890766077c527/advisories/github-reviewed/2026/03/GHSA-8v4x-mgvp-p658/GHSA-8v4x-mgvp-p658.json", "id": "GHSA-8v4x-mgvp-p658", "packages": ["io.undertow:undertow-core"], "path": "advisories/github-reviewed/2026/03/GHSA-8v4x-mgvp-p658/GHSA-8v4x-mgvp-p658.json", "severity": "HIGH", "status": "changed", "summary": "Undertow is Vulnerable to HTTP Request/Response Smuggling"}, {"advisory": "https://github.com/advisories/GHSA-cpm7-cfpx-3hvp", "aliases": ["CVE-2026-35571"], "commit": "https://github.com/github/advisory-database/commit/8112fa5b5b7559a0e8943561151e07470a3c385f", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/8112fa5b5b7559a0e8943561151e07470a3c385f/advisories/github-reviewed/2026/04/GHSA-cpm7-cfpx-3hvp/GHSA-cpm7-cfpx-3hvp.json", "id": "GHSA-cpm7-cfpx-3hvp", "packages": ["gov.nsa.emissary:emissary"], "path": "advisories/github-reviewed/2026/04/GHSA-cpm7-cfpx-3hvp/GHSA-cpm7-cfpx-3hvp.json", "severity": "MODERATE", "status": "changed", "summary": "Emissary has Stored XSS via Navigation Template Link Injection"}, {"advisory": "https://github.com/advisories/GHSA-6c37-7w4p-jg9v", "aliases": ["CVE-2026-35581"], "commit": "https://github.com/github/advisory-database/commit/8adf6e5342ddaa03a1abd50efc92ebb7b579ccd9", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/8adf6e5342ddaa03a1abd50efc92ebb7b579ccd9/advisories/github-reviewed/2026/04/GHSA-6c37-7w4p-jg9v/GHSA-6c37-7w4p-jg9v.json", "id": "GHSA-6c37-7w4p-jg9v", "packages": ["gov.nsa.emissary:emissary"], "path": "advisories/github-reviewed/2026/04/GHSA-6c37-7w4p-jg9v/GHSA-6c37-7w4p-jg9v.json", "severity": "HIGH", "status": "changed", "summary": "Emissary has a Command Injection via PLACE_NAME Configuration in Executrix"}, {"advisory": "https://github.com/advisories/GHSA-3p24-9x7v-7789", "aliases": ["CVE-2026-35582"], "commit": "https://github.com/github/advisory-database/commit/5b0c85124f9b9941dd868281ae501e0f1af43c84", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/5b0c85124f9b9941dd868281ae501e0f1af43c84/advisories/github-reviewed/2026/04/GHSA-3p24-9x7v-7789/GHSA-3p24-9x7v-7789.json", "id": "GHSA-3p24-9x7v-7789", "packages": ["gov.nsa.emissary:emissary"], "path": "advisories/github-reviewed/2026/04/GHSA-3p24-9x7v-7789/GHSA-3p24-9x7v-7789.json", "severity": "HIGH", "status": "changed", "summary": "Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix"}, {"advisory": "https://github.com/advisories/GHSA-c6q7-wqw2-h65w", "aliases": ["CVE-2026-54442"], "commit": "https://github.com/github/advisory-database/commit/af48dd6ab7a731fb14bc7595633f963711f56d48", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/af48dd6ab7a731fb14bc7595633f963711f56d48/advisories/github-reviewed/2026/10/GHSA-c6q7-wqw2-h65w/GHSA-c6q7-wqw2-h65w.json", "id": "GHSA-c6q7-wqw2-h65w", "packages": ["gov.nsa.emissary:emissary"], "path": "advisories/github-reviewed/2026/10/GHSA-c6q7-wqw2-h65w/GHSA-c6q7-wqw2-h65w.json", "severity": "MODERATE", "status": "changed", "summary": "NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571"}, {"advisory": "https://github.com/advisories/GHSA-p3fp-8748-vqfq", "aliases": ["CVE-2025-26699"], "commit": "https://github.com/github/advisory-database/commit/50abec1c963f54b5c2d98b878e2f098303d55c52", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/50abec1c963f54b5c2d98b878e2f098303d55c52/advisories/github-reviewed/2025/03/GHSA-p3fp-8748-vqfq/GHSA-p3fp-8748-vqfq.json", "id": "GHSA-p3fp-8748-vqfq", "packages": ["Django"], "path": "advisories/github-reviewed/2025/03/GHSA-p3fp-8748-vqfq/GHSA-p3fp-8748-vqfq.json", "severity": "MODERATE", "status": "changed", "summary": "Django Vulnerable to Allocation of Resources Without Limits or Throttling"}, {"advisory": "https://github.com/advisories/GHSA-8fcf-v89g-xpg6", "aliases": ["CVE-2026-88010"], "commit": "https://github.com/github/advisory-database/commit/23f656e6e34e93e7139a5410d318da166d406828", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/23f656e6e34e93e7139a5410d318da166d406828/advisories/github-reviewed/2026/09/GHSA-8fcf-v89g-xpg6/GHSA-8fcf-v89g-xpg6.json", "id": "GHSA-8fcf-v89g-xpg6", "packages": ["github.com/traefik/traefik/v3", "github.com/traefik/traefik"], "path": "advisories/github-reviewed/2026/09/GHSA-8fcf-v89g-xpg6/GHSA-8fcf-v89g-xpg6.json", "severity": "MODERATE", "status": "changed", "summary": "Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle"}, {"advisory": "https://github.com/advisories/GHSA-gfjv-gqf2-c888", "aliases": ["CVE-2026-79767"], "commit": "https://github.com/github/advisory-database/commit/ac30616de113be598fed3bb7e191a7a3e6ebb5f6", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/ac30616de113be598fed3bb7e191a7a3e6ebb5f6/advisories/github-reviewed/2026/09/GHSA-gfjv-gqf2-c888/GHSA-gfjv-gqf2-c888.json", "id": "GHSA-gfjv-gqf2-c888", "packages": ["github.com/gardener/gardener"], "path": "advisories/github-reviewed/2026/09/GHSA-gfjv-gqf2-c888/GHSA-gfjv-gqf2-c888.json", "severity": "MODERATE", "status": "changed", "summary": "Gardener: Authorization Bypass via Group Subject Injection"}, {"advisory": "https://github.com/advisories/GHSA-fjwv-jf2v-j499", "aliases": ["CVE-2026-61681"], "commit": "https://github.com/github/advisory-database/commit/d5733ce882a9ba49496bd0dda44c271f74fff63f", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/d5733ce882a9ba49496bd0dda44c271f74fff63f/advisories/github-reviewed/2026/09/GHSA-fjwv-jf2v-j499/GHSA-fjwv-jf2v-j499.json", "id": "GHSA-fjwv-jf2v-j499", "packages": ["github.com/hatchet-dev/hatchet"], "path": "advisories/github-reviewed/2026/09/GHSA-fjwv-jf2v-j499/GHSA-fjwv-jf2v-j499.json", "severity": "MODERATE", "status": "changed", "summary": "Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler"}, {"advisory": "https://github.com/advisories/GHSA-phg3-3g28-wq9v", "aliases": ["CVE-2026-61687"], "commit": "https://github.com/github/advisory-database/commit/19e0cb6241793d628a63cb215eb69946acd3eb28", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/19e0cb6241793d628a63cb215eb69946acd3eb28/advisories/github-reviewed/2026/09/GHSA-phg3-3g28-wq9v/GHSA-phg3-3g28-wq9v.json", "id": "GHSA-phg3-3g28-wq9v", "packages": ["github.com/hatchet-dev/hatchet"], "path": "advisories/github-reviewed/2026/09/GHSA-phg3-3g28-wq9v/GHSA-phg3-3g28-wq9v.json", "severity": "HIGH", "status": "changed", "summary": "Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState"}], "sourceId": "advisories-reviewed", "text": "On November 4, 2026, GitHub's security advisory list published 17 new advisories, changed 46, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 45785, "fingerprint": "0d8a3a45dccea10473d5af150a64019a8d4eb56063609241430aa676b5f08c26", "url": "https://flarereef.flareforward.com/files/watch/0d8a3a45dccea10473d5af150a64019a8d4eb56063609241430aa676b5f08c26.json"}}}, "parsed": {"counts": {"changed": 46, "published": 17, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-04", "kind": "watch-day", "recordedAt": "2026-11-05T02:02:47Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-7p85-w9px-jpjp", "aliases": ["CVE-2026-46633"], "commit": "https://github.com/github/advisory-database/commit/8d8209a50cacdad85184e017ac9d9cec92b4e0cb", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/8d8209a50cacdad85184e017ac9d9cec92b4e0cb/advisories/github-reviewed/2026/05/GHSA-7p85-w9px-jpjp/GHSA-7p85-w9px-jpjp.json", "id": "GHSA-7p85-w9px-jpjp", "packages": ["twig/twig"], "path": "advisories/github-reviewed/2026/05/GHSA-7p85-w9px-jpjp/GHSA-7p85-w9px-jpjp.json", "severity": "CRITICAL", "status": "changed", "summary": "Twig: PHP code injection via `{% use %}` template name"}, {"advisory": "https://github.com/advisories/GHSA-659w-93r5-9j6m", "aliases": ["CVE-2026-42440"], "commit": "https://github.com/github/advisory-database/commit/d29f93b34c304df05cd3a23ea898c61ebb69d2ea", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/d29f93b34c304df05cd3a23ea898c61ebb69d2ea/advisories/github-reviewed/2026/05/GHSA-659w-93r5-9j6m/GHSA-659w-93r5-9j6m.json", "id": "GHSA-659w-93r5-9j6m", "packages": ["org.apache.opennlp:opennlp-tools"], "path": "advisories/github-reviewed/2026/05/GHSA-659w-93r5-9j6m/GHSA-659w-93r5-9j6m.json", "severity": "HIGH", "status": "changed", "summary": "Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation"}, {"advisory": "https://github.com/advisories/GHSA-63cw-57p8-fm3p", "aliases": ["CVE-2026-24747"], "commit": "https://github.com/github/advisory-database/commit/568487bb4bb7928f51234182640bce237067a8c9", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/568487bb4bb7928f51234182640bce237067a8c9/advisories/github-reviewed/2026/01/GHSA-63cw-57p8-fm3p/GHSA-63cw-57p8-fm3p.json", "id": "GHSA-63cw-57p8-fm3p", "packages": ["torch"], "path": "advisories/github-reviewed/2026/01/GHSA-63cw-57p8-fm3p/GHSA-63cw-57p8-fm3p.json", "severity": "HIGH", "status": "changed", "summary": "PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files"}, {"advisory": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg", "aliases": ["CVE-2025-13465"], "commit": "https://github.com/github/advisory-database/commit/378cd3bf07dd1a59610cd65c576008e5b586979f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/378cd3bf07dd1a59610cd65c576008e5b586979f/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json", "id": "GHSA-xxjr-mmjv-4gpg", "packages": ["lodash", "lodash-amd", "lodash-es", "lodash.omit", "lodash.unset"], "path": "advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json", "severity": "MODERATE", "status": "changed", "summary": "Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions"}, {"advisory": "https://github.com/advisories/GHSA-mgp5-rv84-w37q", "aliases": ["CVE-2026-24734"], "commit": "https://github.com/github/advisory-database/commit/5f5b41b00513c7ce1e843053d1d22999dafca0b0", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/5f5b41b00513c7ce1e843053d1d22999dafca0b0/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json", "id": "GHSA-mgp5-rv84-w37q", "packages": ["org.apache.tomcat:tomcat-coyote", "org.apache.tomcat.embed:tomcat-embed-core", "org.apache.tomcat:tomcat-coyote-ffm"], "path": "advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json", "severity": "HIGH", "status": "changed", "summary": "Apache Tomcat has an Improper Input Validation vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-68j8-pq59-fqgm", "aliases": ["CVE-2026-0847"], "commit": "https://github.com/github/advisory-database/commit/5f5b41b00513c7ce1e843053d1d22999dafca0b0", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/5f5b41b00513c7ce1e843053d1d22999dafca0b0/advisories/github-reviewed/2026/03/GHSA-68j8-pq59-fqgm/GHSA-68j8-pq59-fqgm.json", "id": "GHSA-68j8-pq59-fqgm", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/03/GHSA-68j8-pq59-fqgm/GHSA-68j8-pq59-fqgm.json", "severity": "HIGH", "status": "changed", "summary": "NLTK has a Path Traversal issue"}, {"advisory": "https://github.com/advisories/GHSA-3r9x-f23j-gc73", "aliases": ["CVE-2026-27489"], "commit": "https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/03/GHSA-3r9x-f23j-gc73/GHSA-3r9x-f23j-gc73.json", "id": "GHSA-3r9x-f23j-gc73", "packages": ["onnx"], "path": "advisories/github-reviewed/2026/03/GHSA-3r9x-f23j-gc73/GHSA-3r9x-f23j-gc73.json", "severity": "HIGH", "status": "changed", "summary": "onnx Vulnerable to Path Traversal via Symlink"}, {"advisory": "https://github.com/advisories/GHSA-469j-vmhf-r6v7", "aliases": ["CVE-2026-33236"], "commit": "https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/03/GHSA-469j-vmhf-r6v7/GHSA-469j-vmhf-r6v7.json", "id": "GHSA-469j-vmhf-r6v7", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/03/GHSA-469j-vmhf-r6v7/GHSA-469j-vmhf-r6v7.json", "severity": "HIGH", "status": "changed", "summary": "NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite"}, {"advisory": "https://github.com/advisories/GHSA-qr99-7898-vr7c", "aliases": ["CVE-2026-33433"], "commit": "https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/03/GHSA-qr99-7898-vr7c/GHSA-qr99-7898-vr7c.json", "id": "GHSA-qr99-7898-vr7c", "packages": ["github.com/traefik/traefik/v2", "github.com/traefik/traefik/v3"], "path": "advisories/github-reviewed/2026/03/GHSA-qr99-7898-vr7c/GHSA-qr99-7898-vr7c.json", "severity": "MODERATE", "status": "changed", "summary": "Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField"}, {"advisory": "https://github.com/advisories/GHSA-p423-j2cm-9vmq", "aliases": ["CVE-2026-39892"], "commit": "https://github.com/github/advisory-database/commit/f284b8fa0fe059249764f70c0baaa8135a0312db", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f284b8fa0fe059249764f70c0baaa8135a0312db/advisories/github-reviewed/2026/04/GHSA-p423-j2cm-9vmq/GHSA-p423-j2cm-9vmq.json", "id": "GHSA-p423-j2cm-9vmq", "packages": ["cryptography"], "path": "advisories/github-reviewed/2026/04/GHSA-p423-j2cm-9vmq/GHSA-p423-j2cm-9vmq.json", "severity": "MODERATE", "status": "changed", "summary": "Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs"}, {"advisory": "https://github.com/advisories/GHSA-p93r-85wp-75v3", "aliases": ["CVE-2026-5598"], "commit": "https://github.com/github/advisory-database/commit/fd0f6e20b23c4d395ac90a0f97fe2f4fad2b1cd3", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/fd0f6e20b23c4d395ac90a0f97fe2f4fad2b1cd3/advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json", "id": "GHSA-p93r-85wp-75v3", "packages": ["org.bouncycastle:bcprov-jdk15to18", "org.bouncycastle:bcprov-jdk14", "org.bouncycastle:bcprov-jdk18on"], "path": "advisories/github-reviewed/2026/04/GHSA-p93r-85wp-75v3/GHSA-p93r-85wp-75v3.json", "severity": "HIGH", "status": "changed", "summary": "Bouncy Castle Has Covert Timing Channel Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-c3fc-8qff-9hwx", "aliases": ["CVE-2026-0636"], "commit": "https://github.com/github/advisory-database/commit/257898fe95916c61b45527df993e2f2fa485bf94", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/257898fe95916c61b45527df993e2f2fa485bf94/advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json", "id": "GHSA-c3fc-8qff-9hwx", "packages": ["org.bouncycastle:bcprov-jdk14", "org.bouncycastle:bcprov-jdk15to18", "org.bouncycastle:bcprov-jdk18on"], "path": "advisories/github-reviewed/2026/04/GHSA-c3fc-8qff-9hwx/GHSA-c3fc-8qff-9hwx.json", "severity": "MODERATE", "status": "changed", "summary": "Bouncy Castle has an LDAP injection"}, {"advisory": "https://github.com/advisories/GHSA-v3vg-332r-mw99", "aliases": ["CVE-2026-40048"], "commit": "https://github.com/github/advisory-database/commit/c838fdf54fffc232e4559792eb1b1b915d5b0d60", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/c838fdf54fffc232e4559792eb1b1b915d5b0d60/advisories/github-reviewed/2026/04/GHSA-v3vg-332r-mw99/GHSA-v3vg-332r-mw99.json", "id": "GHSA-v3vg-332r-mw99", "packages": ["org.apache.camel:camel-pqc"], "path": "advisories/github-reviewed/2026/04/GHSA-v3vg-332r-mw99/GHSA-v3vg-332r-mw99.json", "severity": "HIGH", "status": "changed", "summary": "Camel-PQC Vulnerable to Deserialization of Untrusted Data"}, {"advisory": "https://github.com/advisories/GHSA-26hh-7cqf-hhc6", "aliases": ["CVE-2026-45109"], "commit": "https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-26hh-7cqf-hhc6/GHSA-26hh-7cqf-hhc6.json", "id": "GHSA-26hh-7cqf-hhc6", "packages": ["next"], "path": "advisories/github-reviewed/2026/05/GHSA-26hh-7cqf-hhc6/GHSA-26hh-7cqf-hhc6.json", "severity": "HIGH", "status": "changed", "summary": "Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up"}, {"advisory": "https://github.com/advisories/GHSA-55hx-c926-fr95", "aliases": ["CVE-2026-26332"], "commit": "https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-55hx-c926-fr95/GHSA-55hx-c926-fr95.json", "id": "GHSA-55hx-c926-fr95", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-55hx-c926-fr95/GHSA-55hx-c926-fr95.json", "severity": "CRITICAL", "status": "changed", "summary": "VM2 Has a Sandbox Escape Issue via SuppressedError"}, {"advisory": "https://github.com/advisories/GHSA-grj5-jjm8-h35p", "aliases": ["CVE-2026-24118"], "commit": "https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-grj5-jjm8-h35p/GHSA-grj5-jjm8-h35p.json", "id": "GHSA-grj5-jjm8-h35p", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-grj5-jjm8-h35p/GHSA-grj5-jjm8-h35p.json", "severity": "CRITICAL", "status": "changed", "summary": "VM2 Sandbox Breakout Through __lookupGetter__"}, {"advisory": "https://github.com/advisories/GHSA-v37h-5mfm-c47c", "aliases": ["CVE-2026-24781"], "commit": "https://github.com/github/advisory-database/commit/7762634d412ae6fb8a9c51cd747312c11754c146", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7762634d412ae6fb8a9c51cd747312c11754c146/advisories/github-reviewed/2026/05/GHSA-v37h-5mfm-c47c/GHSA-v37h-5mfm-c47c.json", "id": "GHSA-v37h-5mfm-c47c", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-v37h-5mfm-c47c/GHSA-v37h-5mfm-c47c.json", "severity": "CRITICAL", "status": "changed", "summary": "VM2 Has Sandbox Breakout Through Inspect Function"}, {"advisory": "https://github.com/advisories/GHSA-8hg8-63c5-gwmx", "aliases": ["CVE-2026-44007"], "commit": "https://github.com/github/advisory-database/commit/f5a2d1ff6e7b5791366faa2b74615534a1a1462e", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/f5a2d1ff6e7b5791366faa2b74615534a1a1462e/advisories/github-reviewed/2026/05/GHSA-8hg8-63c5-gwmx/GHSA-8hg8-63c5-gwmx.json", "id": "GHSA-8hg8-63c5-gwmx", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-8hg8-63c5-gwmx/GHSA-8hg8-63c5-gwmx.json", "severity": "CRITICAL", "status": "changed", "summary": "vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution"}, {"advisory": "https://github.com/advisories/GHSA-9qj6-qjgg-37qq", "aliases": ["CVE-2026-44008"], "commit": "https://github.com/github/advisory-database/commit/f5a2d1ff6e7b5791366faa2b74615534a1a1462e", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/f5a2d1ff6e7b5791366faa2b74615534a1a1462e/advisories/github-reviewed/2026/05/GHSA-9qj6-qjgg-37qq/GHSA-9qj6-qjgg-37qq.json", "id": "GHSA-9qj6-qjgg-37qq", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-9qj6-qjgg-37qq/GHSA-9qj6-qjgg-37qq.json", "severity": "CRITICAL", "status": "changed", "summary": "vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`"}, {"advisory": "https://github.com/advisories/GHSA-9vg3-4rfj-wgcm", "aliases": ["CVE-2026-44009"], "commit": "https://github.com/github/advisory-database/commit/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f/advisories/github-reviewed/2026/05/GHSA-9vg3-4rfj-wgcm/GHSA-9vg3-4rfj-wgcm.json", "id": "GHSA-9vg3-4rfj-wgcm", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-9vg3-4rfj-wgcm/GHSA-9vg3-4rfj-wgcm.json", "severity": "CRITICAL", "status": "changed", "summary": "vm2 has Sandbox Breakout Through Null Proto Exception"}, {"advisory": "https://github.com/advisories/GHSA-vxpw-j846-p89q", "aliases": ["CVE-2026-12151"], "commit": "https://github.com/github/advisory-database/commit/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b1ba8e3c2f6cc7d9dddcd9678309ecd04a95a26f/advisories/github-reviewed/2026/06/GHSA-vxpw-j846-p89q/GHSA-vxpw-j846-p89q.json", "id": "GHSA-vxpw-j846-p89q", "packages": ["undici"], "path": "advisories/github-reviewed/2026/06/GHSA-vxpw-j846-p89q/GHSA-vxpw-j846-p89q.json", "severity": "HIGH", "status": "changed", "summary": "undici WebSocket client vulnerable to denial of service via fragment count bypass"}, {"advisory": "https://github.com/advisories/GHSA-wp3c-266w-4qfq", "aliases": ["CVE-2026-49293"], "commit": "https://github.com/github/advisory-database/commit/557871daae102762572edbc32c842a7a1a46113a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/557871daae102762572edbc32c842a7a1a46113a/advisories/github-reviewed/2026/06/GHSA-wp3c-266w-4qfq/GHSA-wp3c-266w-4qfq.json", "id": "GHSA-wp3c-266w-4qfq", "packages": ["js-toml"], "path": "advisories/github-reviewed/2026/06/GHSA-wp3c-266w-4qfq/GHSA-wp3c-266w-4qfq.json", "severity": "HIGH", "status": "changed", "summary": "js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals"}, {"advisory": "https://github.com/advisories/GHSA-3fxj-6jh8-hvhx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/9476a7ac3483db5eb8a2acf162787ffc27bebd6c", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/9476a7ac3483db5eb8a2acf162787ffc27bebd6c/advisories/github-reviewed/2026/06/GHSA-3fxj-6jh8-hvhx/GHSA-3fxj-6jh8-hvhx.json", "id": "GHSA-3fxj-6jh8-hvhx", "packages": ["github.com/go-chi/chi/v5/middleware", "github.com/go-chi/chi/v5"], "path": "advisories/github-reviewed/2026/06/GHSA-3fxj-6jh8-hvhx/GHSA-3fxj-6jh8-hvhx.json", "severity": "MODERATE", "status": "changed", "summary": "chi Has an IP Spoofing Vulnerability in `middleware.RealIP`"}, {"advisory": "https://github.com/advisories/GHSA-rp2p-6cmp-jxj9", "aliases": ["CVE-2026-57108"], "commit": "https://github.com/github/advisory-database/commit/3c82703bb98b8d802b37a346686bdc5a605056a2", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/3c82703bb98b8d802b37a346686bdc5a605056a2/advisories/github-reviewed/2026/07/GHSA-rp2p-6cmp-jxj9/GHSA-rp2p-6cmp-jxj9.json", "id": "GHSA-rp2p-6cmp-jxj9", "packages": ["Microsoft.NetCore.App.Runtime.linux-arm", "Microsoft.NetCore.App.Runtime.linux-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-arm", "Microsoft.NetCore.App.Runtime.linux-musl-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-x64", "Microsoft.NetCore.App.Runtime.linux-x64", "Microsoft.NetCore.App.Runtime.osx-arm64", "Microsoft.NetCore.App.Runtime.osx-x64"], "path": "advisories/github-reviewed/2026/07/GHSA-rp2p-6cmp-jxj9/GHSA-rp2p-6cmp-jxj9.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-57108 \u2013 .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-2969-4q4w-w5h3", "aliases": ["CVE-2026-50650"], "commit": "https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/07/GHSA-2969-4q4w-w5h3/GHSA-2969-4q4w-w5h3.json", "id": "GHSA-2969-4q4w-w5h3", "packages": ["Microsoft.WindowsDesktop.App.Runtime.win-x64", "Microsoft.WindowsDesktop.App.Runtime.win-x86", "Microsoft.WindowsDesktop.App.Runtime.win-arm64"], "path": "advisories/github-reviewed/2026/07/GHSA-2969-4q4w-w5h3/GHSA-2969-4q4w-w5h3.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-50650 \u2013 .NET Elevation of Privilege Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-w7cw-xp7h-6j5j", "aliases": ["CVE-2026-50524"], "commit": "https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/07/GHSA-w7cw-xp7h-6j5j/GHSA-w7cw-xp7h-6j5j.json", "id": "GHSA-w7cw-xp7h-6j5j", "packages": ["Microsoft.NetCore.App.Runtime.linux-arm", "Microsoft.NetCore.App.Runtime.linux-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-arm", "Microsoft.NetCore.App.Runtime.linux-musl-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-x64", "Microsoft.NetCore.App.Runtime.linux-x64", "Microsoft.NetCore.App.Runtime.osx-arm64", "Microsoft.NetCore.App.Runtime.osx-x64", "Microsoft.NetCore.App.Runtime.win-arm", "Microsoft.NetCore.App.Runtime.win-arm64", "Microsoft.NetCore.App.Runtime.win-x64", "Microsoft.NetCore.App.Runtime.win-x86"], "path": "advisories/github-reviewed/2026/07/GHSA-w7cw-xp7h-6j5j/GHSA-w7cw-xp7h-6j5j.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-50524 \u2013 .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-wp74-jgxh-gv4q", "aliases": ["CVE-2026-50651"], "commit": "https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/07/GHSA-wp74-jgxh-gv4q/GHSA-wp74-jgxh-gv4q.json", "id": "GHSA-wp74-jgxh-gv4q", "packages": ["Microsoft.NetCore.App.Runtime.linux-arm", "Microsoft.NetCore.App.Runtime.linux-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-arm", "Microsoft.NetCore.App.Runtime.linux-musl-arm64", "Microsoft.NetCore.App.Runtime.linux-musl-x64", "Microsoft.NetCore.App.Runtime.linux-x64", "Microsoft.NetCore.App.Runtime.osx-arm64", "Microsoft.NetCore.App.Runtime.osx-x64", "Microsoft.NetCore.App.Runtime.win-arm", "Microsoft.NetCore.App.Runtime.win-arm64", "Microsoft.NetCore.App.Runtime.win-x64", "Microsoft.NetCore.App.Runtime.win-x86"], "path": "advisories/github-reviewed/2026/07/GHSA-wp74-jgxh-gv4q/GHSA-wp74-jgxh-gv4q.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-50651 \u2013 .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-2j8r-3c22-8565", "aliases": ["CVE-2026-69522"], "commit": "https://github.com/github/advisory-database/commit/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b84b8ea05b18a6e0e292cdbd3904eb25fe1d8db4/advisories/github-reviewed/2026/09/GHSA-2j8r-3c22-8565/GHSA-2j8r-3c22-8565.json", "id": "GHSA-2j8r-3c22-8565", "packages": ["Microsoft.DiaSymReader.Native"], "path": "advisories/github-reviewed/2026/09/GHSA-2j8r-3c22-8565/GHSA-2j8r-3c22-8565.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-69522 \u2013 .NET and Visual Studio Remote Code Execution Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-v653-r55g-hcmg", "aliases": ["CVE-2025-13327"], "commit": "https://github.com/github/advisory-database/commit/7b9d4a76d57210c31547ee6aa9a88f906d4211f0", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/7b9d4a76d57210c31547ee6aa9a88f906d4211f0/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "id": "GHSA-v653-r55g-hcmg", "packages": ["uv"], "path": "advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "severity": "MODERATE", "status": "changed", "summary": "uv has ZIP payload obfuscation through parsing differentials"}, {"advisory": "https://github.com/advisories/GHSA-h5gm-rvw6-2xpx", "aliases": ["CVE-2026-49434"], "commit": "https://github.com/github/advisory-database/commit/9d0e960825d8c8d78f6c45f2a23b9a641a0fcd94", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/9d0e960825d8c8d78f6c45f2a23b9a641a0fcd94/advisories/github-reviewed/2026/06/GHSA-h5gm-rvw6-2xpx/GHSA-h5gm-rvw6-2xpx.json", "id": "GHSA-h5gm-rvw6-2xpx", "packages": ["org.apache.activemq:activemq-broker", "org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-all"], "path": "advisories/github-reviewed/2026/06/GHSA-h5gm-rvw6-2xpx/GHSA-h5gm-rvw6-2xpx.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-f892-4h9f-j7g9", "aliases": ["CVE-2026-49877"], "commit": "https://github.com/github/advisory-database/commit/5aa7f472bdae2377252ee19acf255f7f176f8319", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/5aa7f472bdae2377252ee19acf255f7f176f8319/advisories/github-reviewed/2026/06/GHSA-f892-4h9f-j7g9/GHSA-f892-4h9f-j7g9.json", "id": "GHSA-f892-4h9f-j7g9", "packages": ["org.apache.activemq:apache-activemq"], "path": "advisories/github-reviewed/2026/06/GHSA-f892-4h9f-j7g9/GHSA-f892-4h9f-j7g9.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ Improper Authorization vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-7259-vf48-52q3", "aliases": ["CVE-2026-50734"], "commit": "https://github.com/github/advisory-database/commit/cf4b010fd702de6801178a813c22567fde0e4908", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/cf4b010fd702de6801178a813c22567fde0e4908/advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json", "id": "GHSA-7259-vf48-52q3", "packages": ["org.apache.activemq:activemq-client", "org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-all"], "path": "advisories/github-reviewed/2026/06/GHSA-7259-vf48-52q3/GHSA-7259-vf48-52q3.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-9qj4-v6r6-3wmx", "aliases": ["CVE-2026-50750"], "commit": "https://github.com/github/advisory-database/commit/00388c49ed84e11fd7bbe4c533b00e6a96725296", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/00388c49ed84e11fd7bbe4c533b00e6a96725296/advisories/github-reviewed/2026/06/GHSA-9qj4-v6r6-3wmx/GHSA-9qj4-v6r6-3wmx.json", "id": "GHSA-9qj4-v6r6-3wmx", "packages": ["org.apache.activemq:activemq-broker", "org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-all"], "path": "advisories/github-reviewed/2026/06/GHSA-9qj4-v6r6-3wmx/GHSA-9qj4-v6r6-3wmx.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-f77w-px59-cqf5", "aliases": ["CVE-2026-53917"], "commit": "https://github.com/github/advisory-database/commit/1fd15f5582aefdf9bd05012dedfa1cfb5f2589d3", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/1fd15f5582aefdf9bd05012dedfa1cfb5f2589d3/advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json", "id": "GHSA-f77w-px59-cqf5", "packages": ["org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-all", "org.apache.activemq:activemq-client", "org.apache.activemq:activemq-broker"], "path": "advisories/github-reviewed/2026/06/GHSA-f77w-px59-cqf5/GHSA-f77w-px59-cqf5.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-3cgg-c5pp-57h6", "aliases": ["CVE-2026-113787"], "commit": "https://github.com/github/advisory-database/commit/b5a44f78eb9999143bdf585014ce1ee95d3b1daf", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b5a44f78eb9999143bdf585014ce1ee95d3b1daf/advisories/github-reviewed/2026/11/GHSA-3cgg-c5pp-57h6/GHSA-3cgg-c5pp-57h6.json", "id": "GHSA-3cgg-c5pp-57h6", "packages": ["odf-kit"], "path": "advisories/github-reviewed/2026/11/GHSA-3cgg-c5pp-57h6/GHSA-3cgg-c5pp-57h6.json", "severity": "MODERATE", "status": "published", "summary": "odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values"}, {"advisory": "https://github.com/advisories/GHSA-5v3h-fjv2-54fg", "aliases": ["CVE-2026-55956"], "commit": "https://github.com/github/advisory-database/commit/0de2a17d38c440b5426a30a942fe87d5822155d0", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/0de2a17d38c440b5426a30a942fe87d5822155d0/advisories/github-reviewed/2026/06/GHSA-5v3h-fjv2-54fg/GHSA-5v3h-fjv2-54fg.json", "id": "GHSA-5v3h-fjv2-54fg", "packages": ["org.apache.tomcat.embed:tomcat-embed-core", "org.apache.tomcat:tomcat", "org.apache.tomcat:tomcat-catalina"], "path": "advisories/github-reviewed/2026/06/GHSA-5v3h-fjv2-54fg/GHSA-5v3h-fjv2-54fg.json", "severity": "MODERATE", "status": "published", "summary": "Apache Tomcat has an Improper Authorization vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-7895-gffq-w6jq", "aliases": ["CVE-2026-55957"], "commit": "https://github.com/github/advisory-database/commit/476f281f70f359faf23a310a2a0c7dbe8c151834", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/476f281f70f359faf23a310a2a0c7dbe8c151834/advisories/github-reviewed/2026/06/GHSA-7895-gffq-w6jq/GHSA-7895-gffq-w6jq.json", "id": "GHSA-7895-gffq-w6jq", "packages": ["org.apache.tomcat.embed:tomcat-embed-core", "org.apache.tomcat:tomcat", "org.apache.tomcat:tomcat-catalina"], "path": "advisories/github-reviewed/2026/06/GHSA-7895-gffq-w6jq/GHSA-7895-gffq-w6jq.json", "severity": "HIGH", "status": "published", "summary": "Apache Tomcat has a Missing Critical Step in Authentication vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-c5ph-rghf-fjfj", "aliases": ["CVE-2026-55955"], "commit": "https://github.com/github/advisory-database/commit/abcaa04b68d39d803a109d26ba60fc420f042c61", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/abcaa04b68d39d803a109d26ba60fc420f042c61/advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json", "id": "GHSA-c5ph-rghf-fjfj", "packages": ["org.apache.tomcat:tomcat", "org.apache.tomcat:tomcat-tribes"], "path": "advisories/github-reviewed/2026/06/GHSA-c5ph-rghf-fjfj/GHSA-c5ph-rghf-fjfj.json", "severity": "MODERATE", "status": "published", "summary": "Apache Tomcat has an Improper Authentication vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-mqg3-r7h5-24x4", "aliases": ["CVE-2026-55276"], "commit": "https://github.com/github/advisory-database/commit/e3708cb57e3aa264df797e3c9a17eee4fd6aa769", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/e3708cb57e3aa264df797e3c9a17eee4fd6aa769/advisories/github-reviewed/2026/06/GHSA-mqg3-r7h5-24x4/GHSA-mqg3-r7h5-24x4.json", "id": "GHSA-mqg3-r7h5-24x4", "packages": ["org.apache.tomcat.embed:tomcat-embed-core", "org.apache.tomcat:tomcat", "org.apache.tomcat:tomcat-util-scan"], "path": "advisories/github-reviewed/2026/06/GHSA-mqg3-r7h5-24x4/GHSA-mqg3-r7h5-24x4.json", "severity": "CRITICAL", "status": "published", "summary": "Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-h792-v28v-ppgr", "aliases": ["CVE-2026-53404"], "commit": "https://github.com/github/advisory-database/commit/0bb50231f88a9288477b136731f74619e41e0d6d", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/0bb50231f88a9288477b136731f74619e41e0d6d/advisories/github-reviewed/2026/06/GHSA-h792-v28v-ppgr/GHSA-h792-v28v-ppgr.json", "id": "GHSA-h792-v28v-ppgr", "packages": ["org.apache.tomcat.embed:tomcat-embed-core", "org.apache.tomcat:tomcat", "org.apache.tomcat:tomcat-catalina"], "path": "advisories/github-reviewed/2026/06/GHSA-h792-v28v-ppgr/GHSA-h792-v28v-ppgr.json", "severity": "HIGH", "status": "published", "summary": "Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-pg42-rg8c-j886", "aliases": ["CVE-2026-50229"], "commit": "https://github.com/github/advisory-database/commit/d5e5c5ec0c1a386d1245ffefe8f044e5f5d5d936", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/d5e5c5ec0c1a386d1245ffefe8f044e5f5d5d936/advisories/github-reviewed/2026/06/GHSA-pg42-rg8c-j886/GHSA-pg42-rg8c-j886.json", "id": "GHSA-pg42-rg8c-j886", "packages": ["org.apache.tomcat:tomcat"], "path": "advisories/github-reviewed/2026/06/GHSA-pg42-rg8c-j886/GHSA-pg42-rg8c-j886.json", "severity": "MODERATE", "status": "published", "summary": "Apache Tomcat has a Cross-site Scripting vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "aliases": ["CVE-2026-118764"], "commit": "https://github.com/github/advisory-database/commit/db6b565eb01ac6a316283ef3d177ce76b587c7d0", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/db6b565eb01ac6a316283ef3d177ce76b587c7d0/advisories/github-reviewed/2026/10/GHSA-g3hv-75wg-m249/GHSA-g3hv-75wg-m249.json", "id": "GHSA-g3hv-75wg-m249", "packages": ["minimatch"], "path": "advisories/github-reviewed/2026/10/GHSA-g3hv-75wg-m249/GHSA-g3hv-75wg-m249.json", "severity": "MODERATE", "status": "changed", "summary": "minimatch has potential denial of service via globparts amplification"}, {"advisory": "https://github.com/advisories/GHSA-mc8m-rr6c-r5qr", "aliases": ["CVE-2026-93363"], "commit": "https://github.com/github/advisory-database/commit/8320eee3cbf9f6001f2acc857e0390efd2d75710", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/8320eee3cbf9f6001f2acc857e0390efd2d75710/advisories/github-reviewed/2026/11/GHSA-mc8m-rr6c-r5qr/GHSA-mc8m-rr6c-r5qr.json", "id": "GHSA-mc8m-rr6c-r5qr", "packages": ["@payloadcms/storage-vercel-blob"], "path": "advisories/github-reviewed/2026/11/GHSA-mc8m-rr6c-r5qr/GHSA-mc8m-rr6c-r5qr.json", "severity": "MODERATE", "status": "published", "summary": "@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter"}, {"advisory": "https://github.com/advisories/GHSA-93cm-2v4m-c56c", "aliases": ["CVE-2026-55098"], "commit": "https://github.com/github/advisory-database/commit/fcd0d8752081d5aaef409e634881b062cadd651c", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/fcd0d8752081d5aaef409e634881b062cadd651c/advisories/github-reviewed/2026/11/GHSA-93cm-2v4m-c56c/GHSA-93cm-2v4m-c56c.json", "id": "GHSA-93cm-2v4m-c56c", "packages": ["github.com/basekick-labs/arc"], "path": "advisories/github-reviewed/2026/11/GHSA-93cm-2v4m-c56c/GHSA-93cm-2v4m-c56c.json", "severity": "MODERATE", "status": "published", "summary": "Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735"}, {"advisory": "https://github.com/advisories/GHSA-xq3m-2v4x-88gg", "aliases": ["CVE-2026-41242"], "commit": "https://github.com/github/advisory-database/commit/767f96481e4e169de400e47608b0e550af6ad319", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/767f96481e4e169de400e47608b0e550af6ad319/advisories/github-reviewed/2026/04/GHSA-xq3m-2v4x-88gg/GHSA-xq3m-2v4x-88gg.json", "id": "GHSA-xq3m-2v4x-88gg", "packages": ["protobufjs"], "path": "advisories/github-reviewed/2026/04/GHSA-xq3m-2v4x-88gg/GHSA-xq3m-2v4x-88gg.json", "severity": "CRITICAL", "status": "changed", "summary": "protobufjs has an arbitrary code execution issue"}, {"advisory": "https://github.com/advisories/GHSA-6f2p-2qg2-qqch", "aliases": ["CVE-2026-13322"], "commit": "https://github.com/github/advisory-database/commit/64f29619e3facde666a5656253caba04a35f598a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/64f29619e3facde666a5656253caba04a35f598a/advisories/github-reviewed/2026/06/GHSA-6f2p-2qg2-qqch/GHSA-6f2p-2qg2-qqch.json", "id": "GHSA-6f2p-2qg2-qqch", "packages": ["github.com/kubevirt/kubevirt"], "path": "advisories/github-reviewed/2026/06/GHSA-6f2p-2qg2-qqch/GHSA-6f2p-2qg2-qqch.json", "severity": "LOW", "status": "changed", "summary": "KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption"}, {"advisory": "https://github.com/advisories/GHSA-cgm6-wvp9-4g5h", "aliases": ["CVE-2026-13318"], "commit": "https://github.com/github/advisory-database/commit/64f29619e3facde666a5656253caba04a35f598a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/64f29619e3facde666a5656253caba04a35f598a/advisories/github-reviewed/2026/06/GHSA-cgm6-wvp9-4g5h/GHSA-cgm6-wvp9-4g5h.json", "id": "GHSA-cgm6-wvp9-4g5h", "packages": ["kubevirt.io/kubevirt"], "path": "advisories/github-reviewed/2026/06/GHSA-cgm6-wvp9-4g5h/GHSA-cgm6-wvp9-4g5h.json", "severity": "MODERATE", "status": "changed", "summary": "KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address"}, {"advisory": "https://github.com/advisories/GHSA-q3jc-42cq-33fj", "aliases": ["CVE-2026-13218"], "commit": "https://github.com/github/advisory-database/commit/495a5678d0934a9fc2047202e2999a981b261e4c", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/495a5678d0934a9fc2047202e2999a981b261e4c/advisories/github-reviewed/2026/06/GHSA-q3jc-42cq-33fj/GHSA-q3jc-42cq-33fj.json", "id": "GHSA-q3jc-42cq-33fj", "packages": ["kubevirt.io/kubevirt"], "path": "advisories/github-reviewed/2026/06/GHSA-q3jc-42cq-33fj/GHSA-q3jc-42cq-33fj.json", "severity": "MODERATE", "status": "changed", "summary": "KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite"}, {"advisory": "https://github.com/advisories/GHSA-7g64-f2hm-vjxp", "aliases": ["CVE-2026-12975"], "commit": "https://github.com/github/advisory-database/commit/c17d5cb32d992acd951c598ed4d9a2a0679fd180", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/c17d5cb32d992acd951c598ed4d9a2a0679fd180/advisories/github-reviewed/2026/06/GHSA-7g64-f2hm-vjxp/GHSA-7g64-f2hm-vjxp.json", "id": "GHSA-7g64-f2hm-vjxp", "packages": ["io.apicurio:apicurio-registry-schema-util-common"], "path": "advisories/github-reviewed/2026/06/GHSA-7g64-f2hm-vjxp/GHSA-7g64-f2hm-vjxp.json", "severity": "HIGH", "status": "published", "summary": "Apicurio Registry utilities allow SSRF and denial of service through XML parsing"}, {"advisory": "https://github.com/advisories/GHSA-rcmh-vfq7-8gf4", "aliases": ["CVE-2026-12992"], "commit": "https://github.com/github/advisory-database/commit/fd60a4de4b7272f2342c6b37dd2a4778f722a899", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/fd60a4de4b7272f2342c6b37dd2a4778f722a899/advisories/github-reviewed/2026/06/GHSA-rcmh-vfq7-8gf4/GHSA-rcmh-vfq7-8gf4.json", "id": "GHSA-rcmh-vfq7-8gf4", "packages": ["io.apicurio:apicurio-registry-schema-util-wsdl"], "path": "advisories/github-reviewed/2026/06/GHSA-rcmh-vfq7-8gf4/GHSA-rcmh-vfq7-8gf4.json", "severity": "HIGH", "status": "published", "summary": "Apicurio Registry allows upload of WSDL raising HTTP request "}, {"advisory": "https://github.com/advisories/GHSA-748j-wm96-4wh5", "aliases": ["CVE-2026-12993"], "commit": "https://github.com/github/advisory-database/commit/53298e035bd2729cafe5a51d768fd8a32d7cbb17", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/53298e035bd2729cafe5a51d768fd8a32d7cbb17/advisories/github-reviewed/2026/06/GHSA-748j-wm96-4wh5/GHSA-748j-wm96-4wh5.json", "id": "GHSA-748j-wm96-4wh5", "packages": ["io.apicurio:apicurio-registry-schema-util-xml"], "path": "advisories/github-reviewed/2026/06/GHSA-748j-wm96-4wh5/GHSA-748j-wm96-4wh5.json", "severity": "MODERATE", "status": "published", "summary": "Apicurio Registry is vulnerable to denial of service through XML entity expansion"}, {"advisory": "https://github.com/advisories/GHSA-vqqj-9cmv-hx43", "aliases": ["CVE-2026-28369"], "commit": "https://github.com/github/advisory-database/commit/7a766ee5a5ba897bab2181e56b8275e9cfb2349c", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/7a766ee5a5ba897bab2181e56b8275e9cfb2349c/advisories/github-reviewed/2026/03/GHSA-vqqj-9cmv-hx43/GHSA-vqqj-9cmv-hx43.json", "id": "GHSA-vqqj-9cmv-hx43", "packages": ["io.undertow:undertow-core"], "path": "advisories/github-reviewed/2026/03/GHSA-vqqj-9cmv-hx43/GHSA-vqqj-9cmv-hx43.json", "severity": "HIGH", "status": "changed", "summary": "Undertow is Vulnerable to HTTP Request/Response Smuggling"}, {"advisory": "https://github.com/advisories/GHSA-3gv6-g396-9v4r", "aliases": ["CVE-2026-28367"], "commit": "https://github.com/github/advisory-database/commit/5dba8c957620db8b87373c076694d087e15d7904", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/5dba8c957620db8b87373c076694d087e15d7904/advisories/github-reviewed/2026/03/GHSA-3gv6-g396-9v4r/GHSA-3gv6-g396-9v4r.json", "id": "GHSA-3gv6-g396-9v4r", "packages": ["io.undertow:undertow-core"], "path": "advisories/github-reviewed/2026/03/GHSA-3gv6-g396-9v4r/GHSA-3gv6-g396-9v4r.json", "severity": "HIGH", "status": "changed", "summary": "Undertow is Vulnerable to HTTP Request/Response Smuggling"}, {"advisory": "https://github.com/advisories/GHSA-8v4x-mgvp-p658", "aliases": ["CVE-2026-28368"], "commit": "https://github.com/github/advisory-database/commit/022d1a3e3c163d8ffc76af65f25890766077c527", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/022d1a3e3c163d8ffc76af65f25890766077c527/advisories/github-reviewed/2026/03/GHSA-8v4x-mgvp-p658/GHSA-8v4x-mgvp-p658.json", "id": "GHSA-8v4x-mgvp-p658", "packages": ["io.undertow:undertow-core"], "path": "advisories/github-reviewed/2026/03/GHSA-8v4x-mgvp-p658/GHSA-8v4x-mgvp-p658.json", "severity": "HIGH", "status": "changed", "summary": "Undertow is Vulnerable to HTTP Request/Response Smuggling"}, {"advisory": "https://github.com/advisories/GHSA-cpm7-cfpx-3hvp", "aliases": ["CVE-2026-35571"], "commit": "https://github.com/github/advisory-database/commit/8112fa5b5b7559a0e8943561151e07470a3c385f", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/8112fa5b5b7559a0e8943561151e07470a3c385f/advisories/github-reviewed/2026/04/GHSA-cpm7-cfpx-3hvp/GHSA-cpm7-cfpx-3hvp.json", "id": "GHSA-cpm7-cfpx-3hvp", "packages": ["gov.nsa.emissary:emissary"], "path": "advisories/github-reviewed/2026/04/GHSA-cpm7-cfpx-3hvp/GHSA-cpm7-cfpx-3hvp.json", "severity": "MODERATE", "status": "changed", "summary": "Emissary has Stored XSS via Navigation Template Link Injection"}, {"advisory": "https://github.com/advisories/GHSA-6c37-7w4p-jg9v", "aliases": ["CVE-2026-35581"], "commit": "https://github.com/github/advisory-database/commit/8adf6e5342ddaa03a1abd50efc92ebb7b579ccd9", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/8adf6e5342ddaa03a1abd50efc92ebb7b579ccd9/advisories/github-reviewed/2026/04/GHSA-6c37-7w4p-jg9v/GHSA-6c37-7w4p-jg9v.json", "id": "GHSA-6c37-7w4p-jg9v", "packages": ["gov.nsa.emissary:emissary"], "path": "advisories/github-reviewed/2026/04/GHSA-6c37-7w4p-jg9v/GHSA-6c37-7w4p-jg9v.json", "severity": "HIGH", "status": "changed", "summary": "Emissary has a Command Injection via PLACE_NAME Configuration in Executrix"}, {"advisory": "https://github.com/advisories/GHSA-3p24-9x7v-7789", "aliases": ["CVE-2026-35582"], "commit": "https://github.com/github/advisory-database/commit/5b0c85124f9b9941dd868281ae501e0f1af43c84", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/5b0c85124f9b9941dd868281ae501e0f1af43c84/advisories/github-reviewed/2026/04/GHSA-3p24-9x7v-7789/GHSA-3p24-9x7v-7789.json", "id": "GHSA-3p24-9x7v-7789", "packages": ["gov.nsa.emissary:emissary"], "path": "advisories/github-reviewed/2026/04/GHSA-3p24-9x7v-7789/GHSA-3p24-9x7v-7789.json", "severity": "HIGH", "status": "changed", "summary": "Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix"}, {"advisory": "https://github.com/advisories/GHSA-c6q7-wqw2-h65w", "aliases": ["CVE-2026-54442"], "commit": "https://github.com/github/advisory-database/commit/af48dd6ab7a731fb14bc7595633f963711f56d48", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/af48dd6ab7a731fb14bc7595633f963711f56d48/advisories/github-reviewed/2026/10/GHSA-c6q7-wqw2-h65w/GHSA-c6q7-wqw2-h65w.json", "id": "GHSA-c6q7-wqw2-h65w", "packages": ["gov.nsa.emissary:emissary"], "path": "advisories/github-reviewed/2026/10/GHSA-c6q7-wqw2-h65w/GHSA-c6q7-wqw2-h65w.json", "severity": "MODERATE", "status": "changed", "summary": "NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571"}, {"advisory": "https://github.com/advisories/GHSA-p3fp-8748-vqfq", "aliases": ["CVE-2025-26699"], "commit": "https://github.com/github/advisory-database/commit/50abec1c963f54b5c2d98b878e2f098303d55c52", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/50abec1c963f54b5c2d98b878e2f098303d55c52/advisories/github-reviewed/2025/03/GHSA-p3fp-8748-vqfq/GHSA-p3fp-8748-vqfq.json", "id": "GHSA-p3fp-8748-vqfq", "packages": ["Django"], "path": "advisories/github-reviewed/2025/03/GHSA-p3fp-8748-vqfq/GHSA-p3fp-8748-vqfq.json", "severity": "MODERATE", "status": "changed", "summary": "Django Vulnerable to Allocation of Resources Without Limits or Throttling"}, {"advisory": "https://github.com/advisories/GHSA-8fcf-v89g-xpg6", "aliases": ["CVE-2026-88010"], "commit": "https://github.com/github/advisory-database/commit/23f656e6e34e93e7139a5410d318da166d406828", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/23f656e6e34e93e7139a5410d318da166d406828/advisories/github-reviewed/2026/09/GHSA-8fcf-v89g-xpg6/GHSA-8fcf-v89g-xpg6.json", "id": "GHSA-8fcf-v89g-xpg6", "packages": ["github.com/traefik/traefik/v3", "github.com/traefik/traefik"], "path": "advisories/github-reviewed/2026/09/GHSA-8fcf-v89g-xpg6/GHSA-8fcf-v89g-xpg6.json", "severity": "MODERATE", "status": "changed", "summary": "Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle"}, {"advisory": "https://github.com/advisories/GHSA-gfjv-gqf2-c888", "aliases": ["CVE-2026-79767"], "commit": "https://github.com/github/advisory-database/commit/ac30616de113be598fed3bb7e191a7a3e6ebb5f6", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/ac30616de113be598fed3bb7e191a7a3e6ebb5f6/advisories/github-reviewed/2026/09/GHSA-gfjv-gqf2-c888/GHSA-gfjv-gqf2-c888.json", "id": "GHSA-gfjv-gqf2-c888", "packages": ["github.com/gardener/gardener"], "path": "advisories/github-reviewed/2026/09/GHSA-gfjv-gqf2-c888/GHSA-gfjv-gqf2-c888.json", "severity": "MODERATE", "status": "changed", "summary": "Gardener: Authorization Bypass via Group Subject Injection"}, {"advisory": "https://github.com/advisories/GHSA-fjwv-jf2v-j499", "aliases": ["CVE-2026-61681"], "commit": "https://github.com/github/advisory-database/commit/d5733ce882a9ba49496bd0dda44c271f74fff63f", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/d5733ce882a9ba49496bd0dda44c271f74fff63f/advisories/github-reviewed/2026/09/GHSA-fjwv-jf2v-j499/GHSA-fjwv-jf2v-j499.json", "id": "GHSA-fjwv-jf2v-j499", "packages": ["github.com/hatchet-dev/hatchet"], "path": "advisories/github-reviewed/2026/09/GHSA-fjwv-jf2v-j499/GHSA-fjwv-jf2v-j499.json", "severity": "MODERATE", "status": "changed", "summary": "Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler"}, {"advisory": "https://github.com/advisories/GHSA-phg3-3g28-wq9v", "aliases": ["CVE-2026-61687"], "commit": "https://github.com/github/advisory-database/commit/19e0cb6241793d628a63cb215eb69946acd3eb28", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/19e0cb6241793d628a63cb215eb69946acd3eb28/advisories/github-reviewed/2026/09/GHSA-phg3-3g28-wq9v/GHSA-phg3-3g28-wq9v.json", "id": "GHSA-phg3-3g28-wq9v", "packages": ["github.com/hatchet-dev/hatchet"], "path": "advisories/github-reviewed/2026/09/GHSA-phg3-3g28-wq9v/GHSA-phg3-3g28-wq9v.json", "severity": "HIGH", "status": "changed", "summary": "Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState"}], "sourceId": "advisories-reviewed", "text": "On November 4, 2026, GitHub's security advisory list published 17 new advisories, changed 46, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 45785, "fingerprint": "0d8a3a45dccea10473d5af150a64019a8d4eb56063609241430aa676b5f08c26", "url": "https://flarereef.flareforward.com/files/watch/0d8a3a45dccea10473d5af150a64019a8d4eb56063609241430aa676b5f08c26.json"}}, "project": {"projectId": 20, "name": "Security advisories (GitHub reviewed)", "kind": "watch", "keeper": "GitHub", "jurisdiction": "", "markText": "GH", "shape": "", "what": "GitHub's security advisory list", "repoUrl": "https://github.com/github/advisory-database", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "chunk": "day"}, "date": "2026-11-05", "author": {"name": "Flare Reef watcher", "handle": "", "verified": false}}