{"note": {"noteId": 434, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0x2025255b9e0d573f5cdf61bff9fd75140d1a3f29da9dbfc81270b088d47be403", "content": "{\"counts\":{\"changed\":30,\"published\":10,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-05\",\"fullList\":{\"bytes\":28132,\"fingerprint\":\"ca1ce35f7943dc6abee438812e57095579cb62c8c6c004805a5f01a10a8c9f33\",\"url\":\"https://flarereef.flareforward.com/files/watch/ca1ce35f7943dc6abee438812e57095579cb62c8c6c004805a5f01a10a8c9f33.json\"},\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-06T01:04:48Z\",\"rows\":[{\"advisory\":\"https://github.com/advisories/GHSA-83x9-8wvq-rrcp\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/dad68de093963b3b1162ed904cfde9ba86ce90a2\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/dad68de093963b3b1162ed904cfde9ba86ce90a2/advisories/github-reviewed/2026/07/GHSA-83x9-8wvq-rrcp/GHSA-83x9-8wvq-rrcp.json\",\"id\":\"GHSA-83x9-8wvq-rrcp\",\"packages\":[\"urwid\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-83x9-8wvq-rrcp/GHSA-83x9-8wvq-rrcp.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: urwid: Insecure PRNG and Information Exposure in Web Display Backend\"},{\"advisory\":\"https://github.com/advisories/GHSA-mgrx-3hqw-485h\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/75d28f77c8c68c601120dde65f74a52dab4d9a25\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/75d28f77c8c68c601120dde65f74a52dab4d9a25/advisories/github-reviewed/2026/09/GHSA-mgrx-3hqw-485h/GHSA-mgrx-3hqw-485h.json\",\"id\":\"GHSA-mgrx-3hqw-485h\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2026/09/GHSA-mgrx-3hqw-485h/GHSA-mgrx-3hqw-485h.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)\"},{\"advisory\":\"https://github.com/advisories/GHSA-xjwq-9jw5-jf7w\",\"aliases\":[\"CVE-2026-49432\"],\"commit\":\"https://github.com/github/advisory-database/commit/f0982c3e3f1a9aaf55d09af61bc2a82243d60114\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/f0982c3e3f1a9aaf55d09af61bc2a82243d60114/advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json\",\"id\":\"GHSA-xjwq-9jw5-jf7w\",\"packages\":[\"org.apache.activemq:apache-activemq\",\"org.apache.activemq:activemq-all\",\"org.apache.activemq:activemq-stomp\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-j548-68g5-9j7x\",\"aliases\":[\"CVE-2026-52760\"],\"commit\":\"https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json\",\"id\":\"GHSA-j548-68g5-9j7x\",\"packages\":[\"org.apache.activemq:apache-activemq\",\"org.apache.activemq:activemq-web-console\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting\"},{\"advisory\":\"https://github.com/advisories/GHSA-mhp6-f224-j2c3\",\"aliases\":[\"CVE-2026-54475\"],\"commit\":\"https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json\",\"id\":\"GHSA-mhp6-f224-j2c3\",\"packages\":[\"org.apache.activemq:activemq-broker\",\"org.apache.activemq:activemq-all\",\"org.apache.activemq:apache-activemq\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-rxjr-6c9q-h67x\",\"aliases\":[\"CVE-2026-63188\"],\"commit\":\"https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/08/GHSA-rxjr-6c9q-h67x/GHSA-rxjr-6c9q-h67x.json\",\"id\":\"GHSA-rxjr-6c9q-h67x\",\"packages\":[\"@logto/tunnel\"],\"path\":\"advisories/github-reviewed/2026/08/GHSA-rxjr-6c9q-h67x/GHSA-rxjr-6c9q-h67x.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"logto-tunnel serves files outside `--experience-path` via path traversal\"},{\"advisory\":\"https://github.com/advisories/GHSA-hhf9-qw4v-72xp\",\"aliases\":[\"CVE-2026-12411\"],\"commit\":\"https://github.com/github/advisory-database/commit/ea5c37f32656932910a20139055ba87f3feabada\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/ea5c37f32656932910a20139055ba87f3feabada/advisories/github-reviewed/2026/11/GHSA-hhf9-qw4v-72xp/GHSA-hhf9-qw4v-72xp.json\",\"id\":\"GHSA-hhf9-qw4v-72xp\",\"packages\":[\"github.com/canonical/lxd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-hhf9-qw4v-72xp/GHSA-hhf9-qw4v-72xp.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"lxd allows Cross-guest volume hijack via DevLXD device patch\"},{\"advisory\":\"https://github.com/advisories/GHSA-c9f5-j9c3-mhrg\",\"aliases\":[\"CVE-2026-55622\"],\"commit\":\"https://github.com/github/advisory-database/commit/c8e404abeae21b3533043f93aad3209f563804ee\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/c8e404abeae21b3533043f93aad3209f563804ee/advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json\",\"id\":\"GHSA-c9f5-j9c3-mhrg\",\"packages\":[\"github.com/lxc/incus/v7/cmd/incusd\",\"github.com/lxc/incus\",\"github.com/lxc/incus/v6\",\"github.com/lxc/incus/v7\"],\"path\":\"advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Incus has a project restriction bypass in instance copy across projects\"},{\"advisory\":\"https://github.com/advisories/GHSA-5q7h-w9jf-cx97\",\"aliases\":[\"CVE-2026-105769\"],\"commit\":\"https://github.com/github/advisory-database/commit/11e4da6bbb9646baa1b1b5637faaa51f28d89ee1\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/11e4da6bbb9646baa1b1b5637faaa51f28d89ee1/advisories/github-reviewed/2026/11/GHSA-5q7h-w9jf-cx97/GHSA-5q7h-w9jf-cx97.json\",\"id\":\"GHSA-5q7h-w9jf-cx97\",\"packages\":[\"github.com/chainguard-dev/kaniko\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-5q7h-w9jf-cx97/GHSA-5q7h-w9jf-cx97.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts\"},{\"advisory\":\"https://github.com/advisories/GHSA-f2fc-vc88-6w7q\",\"aliases\":[\"CVE-2026-31862\"],\"commit\":\"https://github.com/github/advisory-database/commit/a15b10a067194389c69e2cbb263f71863a619102\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/a15b10a067194389c69e2cbb263f71863a619102/advisories/github-reviewed/2026/03/GHSA-f2fc-vc88-6w7q/GHSA-f2fc-vc88-6w7q.json\",\"id\":\"GHSA-f2fc-vc88-6w7q\",\"packages\":[\"@siteboon/claude-code-ui\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-f2fc-vc88-6w7q/GHSA-f2fc-vc88-6w7q.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters\"},{\"advisory\":\"https://github.com/advisories/GHSA-64vx-6h2c-rjh7\",\"aliases\":[\"CVE-2026-61536\"],\"commit\":\"https://github.com/github/advisory-database/commit/a15b10a067194389c69e2cbb263f71863a619102\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/a15b10a067194389c69e2cbb263f71863a619102/advisories/github-reviewed/2026/11/GHSA-64vx-6h2c-rjh7/GHSA-64vx-6h2c-rjh7.json\",\"id\":\"GHSA-64vx-6h2c-rjh7\",\"packages\":[\"banks\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-64vx-6h2c-rjh7/GHSA-64vx-6h2c-rjh7.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE\"},{\"advisory\":\"https://github.com/advisories/GHSA-7ph3-grqh-pv9v\",\"aliases\":[\"CVE-2025-53648\"],\"commit\":\"https://github.com/github/advisory-database/commit/ed8973f214955efede5aaa44b424ffff995fe788\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/ed8973f214955efede5aaa44b424ffff995fe788/advisories/github-reviewed/2026/06/GHSA-7ph3-grqh-pv9v/GHSA-7ph3-grqh-pv9v.json\",\"id\":\"GHSA-7ph3-grqh-pv9v\",\"packages\":[\"org.apache.gravitino:catalog-jdbc-common\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-7ph3-grqh-pv9v/GHSA-7ph3-grqh-pv9v.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation\"},{\"advisory\":\"https://github.com/advisories/GHSA-m5ph-mmg5-6w5h\",\"aliases\":[\"CVE-2026-62300\"],\"commit\":\"https://github.com/github/advisory-database/commit/e907c7fd8845f48fe93445783d1b20c0cc128185\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/e907c7fd8845f48fe93445783d1b20c0cc128185/advisories/github-reviewed/2026/11/GHSA-m5ph-mmg5-6w5h/GHSA-m5ph-mmg5-6w5h.json\",\"id\":\"GHSA-m5ph-mmg5-6w5h\",\"packages\":[\"filecoin-pin\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-m5ph-mmg5-6w5h/GHSA-m5ph-mmg5-6w5h.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"filecoin-pin: Unbounded DAG pinning can exhaust server resources\"},{\"advisory\":\"https://github.com/advisories/GHSA-cmxg-94mg-jq94\",\"aliases\":[\"CVE-2026-45325\"],\"commit\":\"https://github.com/github/advisory-database/commit/6d172d33d09e2e30f62cada7169acce533f3a939\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/6d172d33d09e2e30f62cada7169acce533f3a939/advisories/github-reviewed/2026/05/GHSA-cmxg-94mg-jq94/GHSA-cmxg-94mg-jq94.json\",\"id\":\"GHSA-cmxg-94mg-jq94\",\"packages\":[\"@tmlmobilidade/utils\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-cmxg-94mg-jq94/GHSA-cmxg-94mg-jq94.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"@tmlmobilidade/utils has prototype pollution in its setValueAtPath\"},{\"advisory\":\"https://github.com/advisories/GHSA-hggm-x7r9-mm7v\",\"aliases\":[\"CVE-2026-32846\"],\"commit\":\"https://github.com/github/advisory-database/commit/8a02b848107f1d1bc75f077d96c09423d1d80890\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/8a02b848107f1d1bc75f077d96c09423d1d80890/advisories/github-reviewed/2026/03/GHSA-hggm-x7r9-mm7v/GHSA-hggm-x7r9-mm7v.json\",\"id\":\"GHSA-hggm-x7r9-mm7v\",\"packages\":[\"openclaw\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-hggm-x7r9-mm7v/GHSA-hggm-x7r9-mm7v.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"OpenClaw is vulnerable to Path Traversal through path validation bypass\"},{\"advisory\":\"https://github.com/advisories/GHSA-3jp2-3mrg-2vxc\",\"aliases\":[\"CVE-2026-49272\"],\"commit\":\"https://github.com/github/advisory-database/commit/015b4ac6fc6c3d7a2e8cfe351f3d75c80fe5355c\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/015b4ac6fc6c3d7a2e8cfe351f3d75c80fe5355c/advisories/github-reviewed/2026/10/GHSA-3jp2-3mrg-2vxc/GHSA-3jp2-3mrg-2vxc.json\",\"id\":\"GHSA-3jp2-3mrg-2vxc\",\"packages\":[\"oauthlib\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-3jp2-3mrg-2vxc/GHSA-3jp2-3mrg-2vxc.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow\"},{\"advisory\":\"https://github.com/advisories/GHSA-gxp8-m5rq-3m38\",\"aliases\":[\"CVE-2025-11183\"],\"commit\":\"https://github.com/github/advisory-database/commit/2fd074d93c15dd5b3f942200aca4ab022c5940a8\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/2fd074d93c15dd5b3f942200aca4ab022c5940a8/advisories/github-reviewed/2025/10/GHSA-gxp8-m5rq-3m38/GHSA-gxp8-m5rq-3m38.json\",\"id\":\"GHSA-gxp8-m5rq-3m38\",\"packages\":[\"qwc2\"],\"path\":\"advisories/github-reviewed/2025/10/GHSA-gxp8-m5rq-3m38/GHSA-gxp8-m5rq-3m38.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"QGIS QWC2 Cross-Site Scripting vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-2h2p-mvfx-868w\",\"aliases\":[\"CVE-2026-30869\"],\"commit\":\"https://github.com/github/advisory-database/commit/865ad3719da80c9fa4749db2ca509fc96c3ee201\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/865ad3719da80c9fa4749db2ca509fc96c3ee201/advisories/github-reviewed/2026/03/GHSA-2h2p-mvfx-868w/GHSA-2h2p-mvfx-868w.json\",\"id\":\"GHSA-2h2p-mvfx-868w\",\"packages\":[\"github.com/siyuan-note/siyuan/kernel\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-2h2p-mvfx-868w/GHSA-2h2p-mvfx-868w.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage\"},{\"advisory\":\"https://github.com/advisories/GHSA-3g9h-9hp4-654v\",\"aliases\":[\"CVE-2026-33203\"],\"commit\":\"https://github.com/github/advisory-database/commit/f1653eb81183a4d28ae04bdb386ee6f1edb45682\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/f1653eb81183a4d28ae04bdb386ee6f1edb45682/advisories/github-reviewed/2026/03/GHSA-3g9h-9hp4-654v/GHSA-3g9h-9hp4-654v.json\",\"id\":\"GHSA-3g9h-9hp4-654v\",\"packages\":[\"github.com/siyuan-note/siyuan/kernel\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-3g9h-9hp4-654v/GHSA-3g9h-9hp4-654v.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass\"},{\"advisory\":\"https://github.com/advisories/GHSA-4j3x-hhg2-fm2x\",\"aliases\":[\"CVE-2026-32704\"],\"commit\":\"https://github.com/github/advisory-database/commit/c8f7bc8c64a0164ad1d3cf7dd3f625fff5abb7d6\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/c8f7bc8c64a0164ad1d3cf7dd3f625fff5abb7d6/advisories/github-reviewed/2026/03/GHSA-4j3x-hhg2-fm2x/GHSA-4j3x-hhg2-fm2x.json\",\"id\":\"GHSA-4j3x-hhg2-fm2x\",\"packages\":[\"github.com/siyuan-note/siyuan/kernel\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-4j3x-hhg2-fm2x/GHSA-4j3x-hhg2-fm2x.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB\"},{\"advisory\":\"https://github.com/advisories/GHSA-56cv-c5p2-j2wg\",\"aliases\":[\"CVE-2026-32110\"],\"commit\":\"https://github.com/github/advisory-database/commit/3f84de2bbfab5e2cb56a797dc36ee60d378de9c4\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/3f84de2bbfab5e2cb56a797dc36ee60d378de9c4/advisories/github-reviewed/2026/03/GHSA-56cv-c5p2-j2wg/GHSA-56cv-c5p2-j2wg.json\",\"id\":\"GHSA-56cv-c5p2-j2wg\",\"packages\":[\"github.com/siyuan-note/siyuan/kernel\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-56cv-c5p2-j2wg/GHSA-56cv-c5p2-j2wg.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"SiYuan has a Full-Read SSRF via /api/network/forwardProxy\"},{\"advisory\":\"https://github.com/advisories/GHSA-vm69-h85x-8p85\",\"aliases\":[\"CVE-2026-33194\"],\"commit\":\"https://github.com/github/advisory-database/commit/3c6eaabfbdde2e6a3b9d26701f3ce718f6f77267\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/3c6eaabfbdde2e6a3b9d26701f3ce718f6f77267/advisories/github-reviewed/2026/03/GHSA-vm69-h85x-8p85/GHSA-vm69-h85x-8p85.json\",\"id\":\"GHSA-vm69-h85x-8p85\",\"packages\":[\"github.com/siyuan-note/siyuan/kernel\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-vm69-h85x-8p85/GHSA-vm69-h85x-8p85.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)\"},{\"advisory\":\"https://github.com/advisories/GHSA-xh5j-727m-w6gg\",\"aliases\":[\"CVE-2026-45061\"],\"commit\":\"https://github.com/github/advisory-database/commit/a078f9080b4bb1f9fcd3a8e04759dac640d7694a\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/a078f9080b4bb1f9fcd3a8e04759dac640d7694a/advisories/github-reviewed/2026/05/GHSA-xh5j-727m-w6gg/GHSA-xh5j-727m-w6gg.json\",\"id\":\"GHSA-xh5j-727m-w6gg\",\"packages\":[\"budibase\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-xh5j-727m-w6gg/GHSA-xh5j-727m-w6gg.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)\"},{\"advisory\":\"https://github.com/advisories/GHSA-2cm2-m3w5-gp2f\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/05/GHSA-2cm2-m3w5-gp2f/GHSA-2cm2-m3w5-gp2f.json\",\"id\":\"GHSA-2cm2-m3w5-gp2f\",\"packages\":[\"vm2\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-2cm2-m3w5-gp2f/GHSA-2cm2-m3w5-gp2f.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`\"},{\"advisory\":\"https://github.com/advisories/GHSA-c9f5-j9c3-mhrg\",\"aliases\":[\"CVE-2026-55622\"],\"commit\":\"https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json\",\"id\":\"GHSA-c9f5-j9c3-mhrg\",\"packages\":[\"github.com/lxc/incus/v7/cmd/incusd\",\"github.com/lxc/incus/v7\"],\"path\":\"advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Incus has a project restriction bypass in instance copy across projects\"},{\"advisory\":\"https://github.com/advisories/GHSA-v5fq-cf5m-vwv7\",\"aliases\":[\"CVE-2026-33944\"],\"commit\":\"https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/10/GHSA-v5fq-cf5m-vwv7/GHSA-v5fq-cf5m-vwv7.json\",\"id\":\"GHSA-v5fq-cf5m-vwv7\",\"packages\":[\"dolibarr/dolibarr\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-v5fq-cf5m-vwv7/GHSA-v5fq-cf5m-vwv7.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter\"},{\"advisory\":\"https://github.com/advisories/GHSA-64f3-v33m-w89f\",\"aliases\":[\"CVE-2026-55621\"],\"commit\":\"https://github.com/github/advisory-database/commit/791a7d38dba2f98458199d10ad2cc55304c3d3d4\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/791a7d38dba2f98458199d10ad2cc55304c3d3d4/advisories/github-reviewed/2026/08/GHSA-64f3-v33m-w89f/GHSA-64f3-v33m-w89f.json\",\"id\":\"GHSA-64f3-v33m-w89f\",\"packages\":[\"github.com/lxc/incus/v7\",\"github.com/lxc/incus/v6\",\"github.com/lxc/incus\"],\"path\":\"advisories/github-reviewed/2026/08/GHSA-64f3-v33m-w89f/GHSA-64f3-v33m-w89f.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Incus has a project restriction bypass for custom volume copy across projects\"},{\"advisory\":\"https://github.com/advisories/GHSA-48q5-w887-33wv\",\"aliases\":[\"CVE-2026-48751\"],\"commit\":\"https://github.com/github/advisory-database/commit/9843e758d8a6bdf96faba4ba962bdf47011ee643\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/9843e758d8a6bdf96faba4ba962bdf47011ee643/advisories/github-reviewed/2026/06/GHSA-48q5-w887-33wv/GHSA-48q5-w887-33wv.json\",\"id\":\"GHSA-48q5-w887-33wv\",\"packages\":[\"github.com/lxc/incus/v7/cmd/incusd\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-48q5-w887-33wv/GHSA-48q5-w887-33wv.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Incus has a restricted project bypass leading to arbitrary command execution\"},{\"advisory\":\"https://github.com/advisories/GHSA-73hr-m85f-64v9\",\"aliases\":[\"CVE-2026-48750\"],\"commit\":\"https://github.com/github/advisory-database/commit/fec7032b5bb9f790a16067369a11e480722f4fb9\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/fec7032b5bb9f790a16067369a11e480722f4fb9/advisories/github-reviewed/2026/06/GHSA-73hr-m85f-64v9/GHSA-73hr-m85f-64v9.json\",\"id\":\"GHSA-73hr-m85f-64v9\",\"packages\":[\"github.com/lxc/incus/v7/cmd/incusd\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-73hr-m85f-64v9/GHSA-73hr-m85f-64v9.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Incus has an arbitrary file write on host via `exec-output` symlink in crafted image\"},{\"advisory\":\"https://github.com/advisories/GHSA-wp5r-2gw5-m7q7\",\"aliases\":[\"CVE-2026-44003\"],\"commit\":\"https://github.com/github/advisory-database/commit/39caaca4c1b43ae1b1b262f5e83159cbd9e145c3\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/39caaca4c1b43ae1b1b262f5e83159cbd9e145c3/advisories/github-reviewed/2026/05/GHSA-wp5r-2gw5-m7q7/GHSA-wp5r-2gw5-m7q7.json\",\"id\":\"GHSA-wp5r-2gw5-m7q7\",\"packages\":[\"vm2\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-wp5r-2gw5-m7q7/GHSA-wp5r-2gw5-m7q7.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"vm2's Transformer Fast-Path Bypass Exposes Internal State Variable\"},{\"advisory\":\"https://github.com/advisories/GHSA-m5w8-4gq2-6f8x\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/e6882087f0d73ac8d9d9fcad3b5371f5e2bbcd4e\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/e6882087f0d73ac8d9d9fcad3b5371f5e2bbcd4e/advisories/github-reviewed/2026/08/GHSA-m5w8-4gq2-6f8x/GHSA-m5w8-4gq2-6f8x.json\",\"id\":\"GHSA-m5w8-4gq2-6f8x\",\"packages\":[\"vm2\"],\"path\":\"advisories/github-reviewed/2026/08/GHSA-m5w8-4gq2-6f8x/GHSA-m5w8-4gq2-6f8x.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` \u2014 process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)\"},{\"advisory\":\"https://github.com/advisories/GHSA-45rp-9p97-h852\",\"aliases\":[\"CVE-2026-28399\"],\"commit\":\"https://github.com/github/advisory-database/commit/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878/advisories/github-reviewed/2026/03/GHSA-45rp-9p97-h852/GHSA-45rp-9p97-h852.json\",\"id\":\"GHSA-45rp-9p97-h852\",\"packages\":[\"nocodb\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-45rp-9p97-h852/GHSA-45rp-9p97-h852.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"NocoDB Vulnerable to SQL Injection via DATEADD Formula\"},{\"advisory\":\"https://github.com/advisories/GHSA-mpp2-x7wv-38hv\",\"aliases\":[\"CVE-2026-28360\"],\"commit\":\"https://github.com/github/advisory-database/commit/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878/advisories/github-reviewed/2026/03/GHSA-mpp2-x7wv-38hv/GHSA-mpp2-x7wv-38hv.json\",\"id\":\"GHSA-mpp2-x7wv-38hv\",\"packages\":[\"nocodb\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-mpp2-x7wv-38hv/GHSA-mpp2-x7wv-38hv.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"NocoDB has Plaintext Storage of Shared View Passwords\"},{\"advisory\":\"https://github.com/advisories/GHSA-p9x3-w98f-7j3q\",\"aliases\":[\"CVE-2026-28361\"],\"commit\":\"https://github.com/github/advisory-database/commit/2a4c7a05de1c8873ea59d5622dab0076bddc3957\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/2a4c7a05de1c8873ea59d5622dab0076bddc3957/advisories/github-reviewed/2026/03/GHSA-p9x3-w98f-7j3q/GHSA-p9x3-w98f-7j3q.json\",\"id\":\"GHSA-p9x3-w98f-7j3q\",\"packages\":[\"nocodb\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-p9x3-w98f-7j3q/GHSA-p9x3-w98f-7j3q.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"NocoDB Missing Ownership Validation in MCP Token Operations\"},{\"advisory\":\"https://github.com/advisories/GHSA-x4vh-j75g-268g\",\"aliases\":[\"CVE-2026-28396\"],\"commit\":\"https://github.com/github/advisory-database/commit/bf4213ab9f1b0ac55849e37db406cc43a18b86ff\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/bf4213ab9f1b0ac55849e37db406cc43a18b86ff/advisories/github-reviewed/2026/03/GHSA-x4vh-j75g-268g/GHSA-x4vh-j75g-268g.json\",\"id\":\"GHSA-x4vh-j75g-268g\",\"packages\":[\"nocodb\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-x4vh-j75g-268g/GHSA-x4vh-j75g-268g.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"NocoDB's Refresh Tokens Not Revoked on Password Reset\"},{\"advisory\":\"https://github.com/advisories/GHSA-7prp-2623-8g45\",\"aliases\":[\"CVE-2026-61599\"],\"commit\":\"https://github.com/github/advisory-database/commit/fb038a5ae11c8a0f19ea670ea43e0fffde2b53b3\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/fb038a5ae11c8a0f19ea670ea43e0fffde2b53b3/advisories/github-reviewed/2026/09/GHSA-7prp-2623-8g45/GHSA-7prp-2623-8g45.json\",\"id\":\"GHSA-7prp-2623-8g45\",\"packages\":[\"djust\"],\"path\":\"advisories/github-reviewed/2026/09/GHSA-7prp-2623-8g45/GHSA-7prp-2623-8g45.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path\"},{\"advisory\":\"https://github.com/advisories/GHSA-vxp5-584q-c479\",\"aliases\":[\"CVE-2026-48752\"],\"commit\":\"https://github.com/github/advisory-database/commit/4c4cdf40232626b41099bc618e36e4b1a18f2f01\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/4c4cdf40232626b41099bc618e36e4b1a18f2f01/advisories/github-reviewed/2026/06/GHSA-vxp5-584q-c479/GHSA-vxp5-584q-c479.json\",\"id\":\"GHSA-vxp5-584q-c479\",\"packages\":[\"github.com/lxc/incus/v7/cmd/incusd\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-vxp5-584q-c479/GHSA-vxp5-584q-c479.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Incus has arbitrary file read+write on host via templates/ symlink in malicious image\"},{\"advisory\":\"https://github.com/advisories/GHSA-2q3f-q5pq-g8wv\",\"aliases\":[\"CVE-2026-48749\"],\"commit\":\"https://github.com/github/advisory-database/commit/4159cc452914e4c6a5796e300c17db0dc9c05736\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/4159cc452914e4c6a5796e300c17db0dc9c05736/advisories/github-reviewed/2026/06/GHSA-2q3f-q5pq-g8wv/GHSA-2q3f-q5pq-g8wv.json\",\"id\":\"GHSA-2q3f-q5pq-g8wv\",\"packages\":[\"github.com/lxc/incus/v7/cmd/incusd\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-2q3f-q5pq-g8wv/GHSA-2q3f-q5pq-g8wv.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image\"},{\"advisory\":\"https://github.com/advisories/GHSA-v6mj-8pf4-hhw4\",\"aliases\":[\"CVE-2026-48755\"],\"commit\":\"https://github.com/github/advisory-database/commit/4e9366c004761377a2fc3e1a09714405e2156140\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/4e9366c004761377a2fc3e1a09714405e2156140/advisories/github-reviewed/2026/06/GHSA-v6mj-8pf4-hhw4/GHSA-v6mj-8pf4-hhw4.json\",\"id\":\"GHSA-v6mj-8pf4-hhw4\",\"packages\":[\"github.com/lxc/incus/v7/cmd/incusd\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-v6mj-8pf4-hhw4/GHSA-v6mj-8pf4-hhw4.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Incus has an argument injection in backup compression algorithm leading to AFW and ACE\"},{\"advisory\":\"https://github.com/advisories/GHSA-f6m5-xw2g-xc4x\",\"aliases\":[\"CVE-2026-48769\"],\"commit\":\"https://github.com/github/advisory-database/commit/c1e192becf23c40e09ea6cb0aac29ae7e195170f\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/c1e192becf23c40e09ea6cb0aac29ae7e195170f/advisories/github-reviewed/2026/06/GHSA-f6m5-xw2g-xc4x/GHSA-f6m5-xw2g-xc4x.json\",\"id\":\"GHSA-f6m5-xw2g-xc4x\",\"packages\":[\"github.com/lxc/incus/v7/cmd/incusd\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-f6m5-xw2g-xc4x/GHSA-f6m5-xw2g-xc4x.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Incus has an arbitrary file write on its client due to trusted image hash\"}],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 5, 2026, GitHub's security advisory list published 10 new advisories, changed 30, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "https://flarereef.flareforward.com/files/watch/ca1ce35f7943dc6abee438812e57095579cb62c8c6c004805a5f01a10a8c9f33.json", "txHash": "0x75c3b2fb5b8c907edc7016b576955e8ddd8486b5798133648917b34e47196ac6", "receiptUrl": "https://flare-explorer.flare.network/tx/0x75c3b2fb5b8c907edc7016b576955e8ddd8486b5798133648917b34e47196ac6", "blockNumber": 73847183, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": [], "parsed": {"counts": {"changed": 30, "published": 10, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-05", "kind": "watch-day", "recordedAt": "2026-11-06T01:04:48Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-83x9-8wvq-rrcp", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/dad68de093963b3b1162ed904cfde9ba86ce90a2", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/dad68de093963b3b1162ed904cfde9ba86ce90a2/advisories/github-reviewed/2026/07/GHSA-83x9-8wvq-rrcp/GHSA-83x9-8wvq-rrcp.json", "id": "GHSA-83x9-8wvq-rrcp", "packages": ["urwid"], "path": "advisories/github-reviewed/2026/07/GHSA-83x9-8wvq-rrcp/GHSA-83x9-8wvq-rrcp.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory: urwid: Insecure PRNG and Information Exposure in Web Display Backend"}, {"advisory": "https://github.com/advisories/GHSA-mgrx-3hqw-485h", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/75d28f77c8c68c601120dde65f74a52dab4d9a25", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/75d28f77c8c68c601120dde65f74a52dab4d9a25/advisories/github-reviewed/2026/09/GHSA-mgrx-3hqw-485h/GHSA-mgrx-3hqw-485h.json", "id": "GHSA-mgrx-3hqw-485h", "packages": ["flowise"], "path": "advisories/github-reviewed/2026/09/GHSA-mgrx-3hqw-485h/GHSA-mgrx-3hqw-485h.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)"}, {"advisory": "https://github.com/advisories/GHSA-xjwq-9jw5-jf7w", "aliases": ["CVE-2026-49432"], "commit": "https://github.com/github/advisory-database/commit/f0982c3e3f1a9aaf55d09af61bc2a82243d60114", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/f0982c3e3f1a9aaf55d09af61bc2a82243d60114/advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json", "id": "GHSA-xjwq-9jw5-jf7w", "packages": ["org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-all", "org.apache.activemq:activemq-stomp"], "path": "advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-j548-68g5-9j7x", "aliases": ["CVE-2026-52760"], "commit": "https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json", "id": "GHSA-j548-68g5-9j7x", "packages": ["org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-web-console"], "path": "advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json", "severity": "MODERATE", "status": "published", "summary": "Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting"}, {"advisory": "https://github.com/advisories/GHSA-mhp6-f224-j2c3", "aliases": ["CVE-2026-54475"], "commit": "https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json", "id": "GHSA-mhp6-f224-j2c3", "packages": ["org.apache.activemq:activemq-broker", "org.apache.activemq:activemq-all", "org.apache.activemq:apache-activemq"], "path": "advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-rxjr-6c9q-h67x", "aliases": ["CVE-2026-63188"], "commit": "https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/08/GHSA-rxjr-6c9q-h67x/GHSA-rxjr-6c9q-h67x.json", "id": "GHSA-rxjr-6c9q-h67x", "packages": ["@logto/tunnel"], "path": "advisories/github-reviewed/2026/08/GHSA-rxjr-6c9q-h67x/GHSA-rxjr-6c9q-h67x.json", "severity": "HIGH", "status": "changed", "summary": "logto-tunnel serves files outside `--experience-path` via path traversal"}, {"advisory": "https://github.com/advisories/GHSA-hhf9-qw4v-72xp", "aliases": ["CVE-2026-12411"], "commit": "https://github.com/github/advisory-database/commit/ea5c37f32656932910a20139055ba87f3feabada", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/ea5c37f32656932910a20139055ba87f3feabada/advisories/github-reviewed/2026/11/GHSA-hhf9-qw4v-72xp/GHSA-hhf9-qw4v-72xp.json", "id": "GHSA-hhf9-qw4v-72xp", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-hhf9-qw4v-72xp/GHSA-hhf9-qw4v-72xp.json", "severity": "HIGH", "status": "published", "summary": "lxd allows Cross-guest volume hijack via DevLXD device patch"}, {"advisory": "https://github.com/advisories/GHSA-c9f5-j9c3-mhrg", "aliases": ["CVE-2026-55622"], "commit": "https://github.com/github/advisory-database/commit/c8e404abeae21b3533043f93aad3209f563804ee", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c8e404abeae21b3533043f93aad3209f563804ee/advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json", "id": "GHSA-c9f5-j9c3-mhrg", "packages": ["github.com/lxc/incus/v7/cmd/incusd", "github.com/lxc/incus", "github.com/lxc/incus/v6", "github.com/lxc/incus/v7"], "path": "advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json", "severity": "HIGH", "status": "changed", "summary": "Incus has a project restriction bypass in instance copy across projects"}, {"advisory": "https://github.com/advisories/GHSA-5q7h-w9jf-cx97", "aliases": ["CVE-2026-105769"], "commit": "https://github.com/github/advisory-database/commit/11e4da6bbb9646baa1b1b5637faaa51f28d89ee1", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/11e4da6bbb9646baa1b1b5637faaa51f28d89ee1/advisories/github-reviewed/2026/11/GHSA-5q7h-w9jf-cx97/GHSA-5q7h-w9jf-cx97.json", "id": "GHSA-5q7h-w9jf-cx97", "packages": ["github.com/chainguard-dev/kaniko"], "path": "advisories/github-reviewed/2026/11/GHSA-5q7h-w9jf-cx97/GHSA-5q7h-w9jf-cx97.json", "severity": "CRITICAL", "status": "published", "summary": "kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts"}, {"advisory": "https://github.com/advisories/GHSA-f2fc-vc88-6w7q", "aliases": ["CVE-2026-31862"], "commit": "https://github.com/github/advisory-database/commit/a15b10a067194389c69e2cbb263f71863a619102", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/a15b10a067194389c69e2cbb263f71863a619102/advisories/github-reviewed/2026/03/GHSA-f2fc-vc88-6w7q/GHSA-f2fc-vc88-6w7q.json", "id": "GHSA-f2fc-vc88-6w7q", "packages": ["@siteboon/claude-code-ui"], "path": "advisories/github-reviewed/2026/03/GHSA-f2fc-vc88-6w7q/GHSA-f2fc-vc88-6w7q.json", "severity": "CRITICAL", "status": "changed", "summary": "@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters"}, {"advisory": "https://github.com/advisories/GHSA-64vx-6h2c-rjh7", "aliases": ["CVE-2026-61536"], "commit": "https://github.com/github/advisory-database/commit/a15b10a067194389c69e2cbb263f71863a619102", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/a15b10a067194389c69e2cbb263f71863a619102/advisories/github-reviewed/2026/11/GHSA-64vx-6h2c-rjh7/GHSA-64vx-6h2c-rjh7.json", "id": "GHSA-64vx-6h2c-rjh7", "packages": ["banks"], "path": "advisories/github-reviewed/2026/11/GHSA-64vx-6h2c-rjh7/GHSA-64vx-6h2c-rjh7.json", "severity": "HIGH", "status": "published", "summary": "Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE"}, {"advisory": "https://github.com/advisories/GHSA-7ph3-grqh-pv9v", "aliases": ["CVE-2025-53648"], "commit": "https://github.com/github/advisory-database/commit/ed8973f214955efede5aaa44b424ffff995fe788", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/ed8973f214955efede5aaa44b424ffff995fe788/advisories/github-reviewed/2026/06/GHSA-7ph3-grqh-pv9v/GHSA-7ph3-grqh-pv9v.json", "id": "GHSA-7ph3-grqh-pv9v", "packages": ["org.apache.gravitino:catalog-jdbc-common"], "path": "advisories/github-reviewed/2026/06/GHSA-7ph3-grqh-pv9v/GHSA-7ph3-grqh-pv9v.json", "severity": "MODERATE", "status": "published", "summary": "Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation"}, {"advisory": "https://github.com/advisories/GHSA-m5ph-mmg5-6w5h", "aliases": ["CVE-2026-62300"], "commit": "https://github.com/github/advisory-database/commit/e907c7fd8845f48fe93445783d1b20c0cc128185", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/e907c7fd8845f48fe93445783d1b20c0cc128185/advisories/github-reviewed/2026/11/GHSA-m5ph-mmg5-6w5h/GHSA-m5ph-mmg5-6w5h.json", "id": "GHSA-m5ph-mmg5-6w5h", "packages": ["filecoin-pin"], "path": "advisories/github-reviewed/2026/11/GHSA-m5ph-mmg5-6w5h/GHSA-m5ph-mmg5-6w5h.json", "severity": "MODERATE", "status": "published", "summary": "filecoin-pin: Unbounded DAG pinning can exhaust server resources"}, {"advisory": "https://github.com/advisories/GHSA-cmxg-94mg-jq94", "aliases": ["CVE-2026-45325"], "commit": "https://github.com/github/advisory-database/commit/6d172d33d09e2e30f62cada7169acce533f3a939", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/6d172d33d09e2e30f62cada7169acce533f3a939/advisories/github-reviewed/2026/05/GHSA-cmxg-94mg-jq94/GHSA-cmxg-94mg-jq94.json", "id": "GHSA-cmxg-94mg-jq94", "packages": ["@tmlmobilidade/utils"], "path": "advisories/github-reviewed/2026/05/GHSA-cmxg-94mg-jq94/GHSA-cmxg-94mg-jq94.json", "severity": "HIGH", "status": "changed", "summary": "@tmlmobilidade/utils has prototype pollution in its setValueAtPath"}, {"advisory": "https://github.com/advisories/GHSA-hggm-x7r9-mm7v", "aliases": ["CVE-2026-32846"], "commit": "https://github.com/github/advisory-database/commit/8a02b848107f1d1bc75f077d96c09423d1d80890", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/8a02b848107f1d1bc75f077d96c09423d1d80890/advisories/github-reviewed/2026/03/GHSA-hggm-x7r9-mm7v/GHSA-hggm-x7r9-mm7v.json", "id": "GHSA-hggm-x7r9-mm7v", "packages": ["openclaw"], "path": "advisories/github-reviewed/2026/03/GHSA-hggm-x7r9-mm7v/GHSA-hggm-x7r9-mm7v.json", "severity": "HIGH", "status": "changed", "summary": "OpenClaw is vulnerable to Path Traversal through path validation bypass"}, {"advisory": "https://github.com/advisories/GHSA-3jp2-3mrg-2vxc", "aliases": ["CVE-2026-49272"], "commit": "https://github.com/github/advisory-database/commit/015b4ac6fc6c3d7a2e8cfe351f3d75c80fe5355c", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/015b4ac6fc6c3d7a2e8cfe351f3d75c80fe5355c/advisories/github-reviewed/2026/10/GHSA-3jp2-3mrg-2vxc/GHSA-3jp2-3mrg-2vxc.json", "id": "GHSA-3jp2-3mrg-2vxc", "packages": ["oauthlib"], "path": "advisories/github-reviewed/2026/10/GHSA-3jp2-3mrg-2vxc/GHSA-3jp2-3mrg-2vxc.json", "severity": "HIGH", "status": "changed", "summary": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow"}, {"advisory": "https://github.com/advisories/GHSA-gxp8-m5rq-3m38", "aliases": ["CVE-2025-11183"], "commit": "https://github.com/github/advisory-database/commit/2fd074d93c15dd5b3f942200aca4ab022c5940a8", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/2fd074d93c15dd5b3f942200aca4ab022c5940a8/advisories/github-reviewed/2025/10/GHSA-gxp8-m5rq-3m38/GHSA-gxp8-m5rq-3m38.json", "id": "GHSA-gxp8-m5rq-3m38", "packages": ["qwc2"], "path": "advisories/github-reviewed/2025/10/GHSA-gxp8-m5rq-3m38/GHSA-gxp8-m5rq-3m38.json", "severity": "MODERATE", "status": "changed", "summary": "QGIS QWC2 Cross-Site Scripting vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-2h2p-mvfx-868w", "aliases": ["CVE-2026-30869"], "commit": "https://github.com/github/advisory-database/commit/865ad3719da80c9fa4749db2ca509fc96c3ee201", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/865ad3719da80c9fa4749db2ca509fc96c3ee201/advisories/github-reviewed/2026/03/GHSA-2h2p-mvfx-868w/GHSA-2h2p-mvfx-868w.json", "id": "GHSA-2h2p-mvfx-868w", "packages": ["github.com/siyuan-note/siyuan/kernel"], "path": "advisories/github-reviewed/2026/03/GHSA-2h2p-mvfx-868w/GHSA-2h2p-mvfx-868w.json", "severity": "CRITICAL", "status": "changed", "summary": "SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage"}, {"advisory": "https://github.com/advisories/GHSA-3g9h-9hp4-654v", "aliases": ["CVE-2026-33203"], "commit": "https://github.com/github/advisory-database/commit/f1653eb81183a4d28ae04bdb386ee6f1edb45682", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/f1653eb81183a4d28ae04bdb386ee6f1edb45682/advisories/github-reviewed/2026/03/GHSA-3g9h-9hp4-654v/GHSA-3g9h-9hp4-654v.json", "id": "GHSA-3g9h-9hp4-654v", "packages": ["github.com/siyuan-note/siyuan/kernel"], "path": "advisories/github-reviewed/2026/03/GHSA-3g9h-9hp4-654v/GHSA-3g9h-9hp4-654v.json", "severity": "HIGH", "status": "changed", "summary": "SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass"}, {"advisory": "https://github.com/advisories/GHSA-4j3x-hhg2-fm2x", "aliases": ["CVE-2026-32704"], "commit": "https://github.com/github/advisory-database/commit/c8f7bc8c64a0164ad1d3cf7dd3f625fff5abb7d6", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c8f7bc8c64a0164ad1d3cf7dd3f625fff5abb7d6/advisories/github-reviewed/2026/03/GHSA-4j3x-hhg2-fm2x/GHSA-4j3x-hhg2-fm2x.json", "id": "GHSA-4j3x-hhg2-fm2x", "packages": ["github.com/siyuan-note/siyuan/kernel"], "path": "advisories/github-reviewed/2026/03/GHSA-4j3x-hhg2-fm2x/GHSA-4j3x-hhg2-fm2x.json", "severity": "MODERATE", "status": "changed", "summary": "SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB"}, {"advisory": "https://github.com/advisories/GHSA-56cv-c5p2-j2wg", "aliases": ["CVE-2026-32110"], "commit": "https://github.com/github/advisory-database/commit/3f84de2bbfab5e2cb56a797dc36ee60d378de9c4", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/3f84de2bbfab5e2cb56a797dc36ee60d378de9c4/advisories/github-reviewed/2026/03/GHSA-56cv-c5p2-j2wg/GHSA-56cv-c5p2-j2wg.json", "id": "GHSA-56cv-c5p2-j2wg", "packages": ["github.com/siyuan-note/siyuan/kernel"], "path": "advisories/github-reviewed/2026/03/GHSA-56cv-c5p2-j2wg/GHSA-56cv-c5p2-j2wg.json", "severity": "HIGH", "status": "changed", "summary": "SiYuan has a Full-Read SSRF via /api/network/forwardProxy"}, {"advisory": "https://github.com/advisories/GHSA-vm69-h85x-8p85", "aliases": ["CVE-2026-33194"], "commit": "https://github.com/github/advisory-database/commit/3c6eaabfbdde2e6a3b9d26701f3ce718f6f77267", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/3c6eaabfbdde2e6a3b9d26701f3ce718f6f77267/advisories/github-reviewed/2026/03/GHSA-vm69-h85x-8p85/GHSA-vm69-h85x-8p85.json", "id": "GHSA-vm69-h85x-8p85", "packages": ["github.com/siyuan-note/siyuan/kernel"], "path": "advisories/github-reviewed/2026/03/GHSA-vm69-h85x-8p85/GHSA-vm69-h85x-8p85.json", "severity": "MODERATE", "status": "changed", "summary": "SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)"}, {"advisory": "https://github.com/advisories/GHSA-xh5j-727m-w6gg", "aliases": ["CVE-2026-45061"], "commit": "https://github.com/github/advisory-database/commit/a078f9080b4bb1f9fcd3a8e04759dac640d7694a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/a078f9080b4bb1f9fcd3a8e04759dac640d7694a/advisories/github-reviewed/2026/05/GHSA-xh5j-727m-w6gg/GHSA-xh5j-727m-w6gg.json", "id": "GHSA-xh5j-727m-w6gg", "packages": ["budibase"], "path": "advisories/github-reviewed/2026/05/GHSA-xh5j-727m-w6gg/GHSA-xh5j-727m-w6gg.json", "severity": "HIGH", "status": "changed", "summary": "Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)"}, {"advisory": "https://github.com/advisories/GHSA-2cm2-m3w5-gp2f", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/05/GHSA-2cm2-m3w5-gp2f/GHSA-2cm2-m3w5-gp2f.json", "id": "GHSA-2cm2-m3w5-gp2f", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-2cm2-m3w5-gp2f/GHSA-2cm2-m3w5-gp2f.json", "severity": "MODERATE", "status": "changed", "summary": "vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`"}, {"advisory": "https://github.com/advisories/GHSA-c9f5-j9c3-mhrg", "aliases": ["CVE-2026-55622"], "commit": "https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json", "id": "GHSA-c9f5-j9c3-mhrg", "packages": ["github.com/lxc/incus/v7/cmd/incusd", "github.com/lxc/incus/v7"], "path": "advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json", "severity": "HIGH", "status": "changed", "summary": "Incus has a project restriction bypass in instance copy across projects"}, {"advisory": "https://github.com/advisories/GHSA-v5fq-cf5m-vwv7", "aliases": ["CVE-2026-33944"], "commit": "https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/10/GHSA-v5fq-cf5m-vwv7/GHSA-v5fq-cf5m-vwv7.json", "id": "GHSA-v5fq-cf5m-vwv7", "packages": ["dolibarr/dolibarr"], "path": "advisories/github-reviewed/2026/10/GHSA-v5fq-cf5m-vwv7/GHSA-v5fq-cf5m-vwv7.json", "severity": "HIGH", "status": "changed", "summary": "Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter"}, {"advisory": "https://github.com/advisories/GHSA-64f3-v33m-w89f", "aliases": ["CVE-2026-55621"], "commit": "https://github.com/github/advisory-database/commit/791a7d38dba2f98458199d10ad2cc55304c3d3d4", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/791a7d38dba2f98458199d10ad2cc55304c3d3d4/advisories/github-reviewed/2026/08/GHSA-64f3-v33m-w89f/GHSA-64f3-v33m-w89f.json", "id": "GHSA-64f3-v33m-w89f", "packages": ["github.com/lxc/incus/v7", "github.com/lxc/incus/v6", "github.com/lxc/incus"], "path": "advisories/github-reviewed/2026/08/GHSA-64f3-v33m-w89f/GHSA-64f3-v33m-w89f.json", "severity": "HIGH", "status": "changed", "summary": "Incus has a project restriction bypass for custom volume copy across projects"}, {"advisory": "https://github.com/advisories/GHSA-48q5-w887-33wv", "aliases": ["CVE-2026-48751"], "commit": "https://github.com/github/advisory-database/commit/9843e758d8a6bdf96faba4ba962bdf47011ee643", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/9843e758d8a6bdf96faba4ba962bdf47011ee643/advisories/github-reviewed/2026/06/GHSA-48q5-w887-33wv/GHSA-48q5-w887-33wv.json", "id": "GHSA-48q5-w887-33wv", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-48q5-w887-33wv/GHSA-48q5-w887-33wv.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has a restricted project bypass leading to arbitrary command execution"}, {"advisory": "https://github.com/advisories/GHSA-73hr-m85f-64v9", "aliases": ["CVE-2026-48750"], "commit": "https://github.com/github/advisory-database/commit/fec7032b5bb9f790a16067369a11e480722f4fb9", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/fec7032b5bb9f790a16067369a11e480722f4fb9/advisories/github-reviewed/2026/06/GHSA-73hr-m85f-64v9/GHSA-73hr-m85f-64v9.json", "id": "GHSA-73hr-m85f-64v9", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-73hr-m85f-64v9/GHSA-73hr-m85f-64v9.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has an arbitrary file write on host via `exec-output` symlink in crafted image"}, {"advisory": "https://github.com/advisories/GHSA-wp5r-2gw5-m7q7", "aliases": ["CVE-2026-44003"], "commit": "https://github.com/github/advisory-database/commit/39caaca4c1b43ae1b1b262f5e83159cbd9e145c3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/39caaca4c1b43ae1b1b262f5e83159cbd9e145c3/advisories/github-reviewed/2026/05/GHSA-wp5r-2gw5-m7q7/GHSA-wp5r-2gw5-m7q7.json", "id": "GHSA-wp5r-2gw5-m7q7", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-wp5r-2gw5-m7q7/GHSA-wp5r-2gw5-m7q7.json", "severity": "MODERATE", "status": "changed", "summary": "vm2's Transformer Fast-Path Bypass Exposes Internal State Variable"}, {"advisory": "https://github.com/advisories/GHSA-m5w8-4gq2-6f8x", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/e6882087f0d73ac8d9d9fcad3b5371f5e2bbcd4e", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/e6882087f0d73ac8d9d9fcad3b5371f5e2bbcd4e/advisories/github-reviewed/2026/08/GHSA-m5w8-4gq2-6f8x/GHSA-m5w8-4gq2-6f8x.json", "id": "GHSA-m5w8-4gq2-6f8x", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/08/GHSA-m5w8-4gq2-6f8x/GHSA-m5w8-4gq2-6f8x.json", "severity": "CRITICAL", "status": "changed", "summary": "vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` \u2014 process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)"}, {"advisory": "https://github.com/advisories/GHSA-45rp-9p97-h852", "aliases": ["CVE-2026-28399"], "commit": "https://github.com/github/advisory-database/commit/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878/advisories/github-reviewed/2026/03/GHSA-45rp-9p97-h852/GHSA-45rp-9p97-h852.json", "id": "GHSA-45rp-9p97-h852", "packages": ["nocodb"], "path": "advisories/github-reviewed/2026/03/GHSA-45rp-9p97-h852/GHSA-45rp-9p97-h852.json", "severity": "MODERATE", "status": "changed", "summary": "NocoDB Vulnerable to SQL Injection via DATEADD Formula"}, {"advisory": "https://github.com/advisories/GHSA-mpp2-x7wv-38hv", "aliases": ["CVE-2026-28360"], "commit": "https://github.com/github/advisory-database/commit/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878/advisories/github-reviewed/2026/03/GHSA-mpp2-x7wv-38hv/GHSA-mpp2-x7wv-38hv.json", "id": "GHSA-mpp2-x7wv-38hv", "packages": ["nocodb"], "path": "advisories/github-reviewed/2026/03/GHSA-mpp2-x7wv-38hv/GHSA-mpp2-x7wv-38hv.json", "severity": "LOW", "status": "changed", "summary": "NocoDB has Plaintext Storage of Shared View Passwords"}, {"advisory": "https://github.com/advisories/GHSA-p9x3-w98f-7j3q", "aliases": ["CVE-2026-28361"], "commit": "https://github.com/github/advisory-database/commit/2a4c7a05de1c8873ea59d5622dab0076bddc3957", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/2a4c7a05de1c8873ea59d5622dab0076bddc3957/advisories/github-reviewed/2026/03/GHSA-p9x3-w98f-7j3q/GHSA-p9x3-w98f-7j3q.json", "id": "GHSA-p9x3-w98f-7j3q", "packages": ["nocodb"], "path": "advisories/github-reviewed/2026/03/GHSA-p9x3-w98f-7j3q/GHSA-p9x3-w98f-7j3q.json", "severity": "MODERATE", "status": "changed", "summary": "NocoDB Missing Ownership Validation in MCP Token Operations"}, {"advisory": "https://github.com/advisories/GHSA-x4vh-j75g-268g", "aliases": ["CVE-2026-28396"], "commit": "https://github.com/github/advisory-database/commit/bf4213ab9f1b0ac55849e37db406cc43a18b86ff", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/bf4213ab9f1b0ac55849e37db406cc43a18b86ff/advisories/github-reviewed/2026/03/GHSA-x4vh-j75g-268g/GHSA-x4vh-j75g-268g.json", "id": "GHSA-x4vh-j75g-268g", "packages": ["nocodb"], "path": "advisories/github-reviewed/2026/03/GHSA-x4vh-j75g-268g/GHSA-x4vh-j75g-268g.json", "severity": "MODERATE", "status": "changed", "summary": "NocoDB's Refresh Tokens Not Revoked on Password Reset"}, {"advisory": "https://github.com/advisories/GHSA-7prp-2623-8g45", "aliases": ["CVE-2026-61599"], "commit": "https://github.com/github/advisory-database/commit/fb038a5ae11c8a0f19ea670ea43e0fffde2b53b3", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/fb038a5ae11c8a0f19ea670ea43e0fffde2b53b3/advisories/github-reviewed/2026/09/GHSA-7prp-2623-8g45/GHSA-7prp-2623-8g45.json", "id": "GHSA-7prp-2623-8g45", "packages": ["djust"], "path": "advisories/github-reviewed/2026/09/GHSA-7prp-2623-8g45/GHSA-7prp-2623-8g45.json", "severity": "HIGH", "status": "changed", "summary": "djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path"}, {"advisory": "https://github.com/advisories/GHSA-vxp5-584q-c479", "aliases": ["CVE-2026-48752"], "commit": "https://github.com/github/advisory-database/commit/4c4cdf40232626b41099bc618e36e4b1a18f2f01", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4c4cdf40232626b41099bc618e36e4b1a18f2f01/advisories/github-reviewed/2026/06/GHSA-vxp5-584q-c479/GHSA-vxp5-584q-c479.json", "id": "GHSA-vxp5-584q-c479", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-vxp5-584q-c479/GHSA-vxp5-584q-c479.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has arbitrary file read+write on host via templates/ symlink in malicious image"}, {"advisory": "https://github.com/advisories/GHSA-2q3f-q5pq-g8wv", "aliases": ["CVE-2026-48749"], "commit": "https://github.com/github/advisory-database/commit/4159cc452914e4c6a5796e300c17db0dc9c05736", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4159cc452914e4c6a5796e300c17db0dc9c05736/advisories/github-reviewed/2026/06/GHSA-2q3f-q5pq-g8wv/GHSA-2q3f-q5pq-g8wv.json", "id": "GHSA-2q3f-q5pq-g8wv", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-2q3f-q5pq-g8wv/GHSA-2q3f-q5pq-g8wv.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image"}, {"advisory": "https://github.com/advisories/GHSA-v6mj-8pf4-hhw4", "aliases": ["CVE-2026-48755"], "commit": "https://github.com/github/advisory-database/commit/4e9366c004761377a2fc3e1a09714405e2156140", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4e9366c004761377a2fc3e1a09714405e2156140/advisories/github-reviewed/2026/06/GHSA-v6mj-8pf4-hhw4/GHSA-v6mj-8pf4-hhw4.json", "id": "GHSA-v6mj-8pf4-hhw4", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-v6mj-8pf4-hhw4/GHSA-v6mj-8pf4-hhw4.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has an argument injection in backup compression algorithm leading to AFW and ACE"}, {"advisory": "https://github.com/advisories/GHSA-f6m5-xw2g-xc4x", "aliases": ["CVE-2026-48769"], "commit": "https://github.com/github/advisory-database/commit/c1e192becf23c40e09ea6cb0aac29ae7e195170f", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c1e192becf23c40e09ea6cb0aac29ae7e195170f/advisories/github-reviewed/2026/06/GHSA-f6m5-xw2g-xc4x/GHSA-f6m5-xw2g-xc4x.json", "id": "GHSA-f6m5-xw2g-xc4x", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-f6m5-xw2g-xc4x/GHSA-f6m5-xw2g-xc4x.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has an arbitrary file write on its client due to trusted image hash"}], "sourceId": "advisories-reviewed", "text": "On November 5, 2026, GitHub's security advisory list published 10 new advisories, changed 30, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 28132, "fingerprint": "ca1ce35f7943dc6abee438812e57095579cb62c8c6c004805a5f01a10a8c9f33", "url": "https://flarereef.flareforward.com/files/watch/ca1ce35f7943dc6abee438812e57095579cb62c8c6c004805a5f01a10a8c9f33.json"}}}, "parsed": {"counts": {"changed": 30, "published": 10, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-05", "kind": "watch-day", "recordedAt": "2026-11-06T01:04:48Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-83x9-8wvq-rrcp", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/dad68de093963b3b1162ed904cfde9ba86ce90a2", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/dad68de093963b3b1162ed904cfde9ba86ce90a2/advisories/github-reviewed/2026/07/GHSA-83x9-8wvq-rrcp/GHSA-83x9-8wvq-rrcp.json", "id": "GHSA-83x9-8wvq-rrcp", "packages": ["urwid"], "path": "advisories/github-reviewed/2026/07/GHSA-83x9-8wvq-rrcp/GHSA-83x9-8wvq-rrcp.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory: urwid: Insecure PRNG and Information Exposure in Web Display Backend"}, {"advisory": "https://github.com/advisories/GHSA-mgrx-3hqw-485h", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/75d28f77c8c68c601120dde65f74a52dab4d9a25", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/75d28f77c8c68c601120dde65f74a52dab4d9a25/advisories/github-reviewed/2026/09/GHSA-mgrx-3hqw-485h/GHSA-mgrx-3hqw-485h.json", "id": "GHSA-mgrx-3hqw-485h", "packages": ["flowise"], "path": "advisories/github-reviewed/2026/09/GHSA-mgrx-3hqw-485h/GHSA-mgrx-3hqw-485h.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)"}, {"advisory": "https://github.com/advisories/GHSA-xjwq-9jw5-jf7w", "aliases": ["CVE-2026-49432"], "commit": "https://github.com/github/advisory-database/commit/f0982c3e3f1a9aaf55d09af61bc2a82243d60114", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/f0982c3e3f1a9aaf55d09af61bc2a82243d60114/advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json", "id": "GHSA-xjwq-9jw5-jf7w", "packages": ["org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-all", "org.apache.activemq:activemq-stomp"], "path": "advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-j548-68g5-9j7x", "aliases": ["CVE-2026-52760"], "commit": "https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json", "id": "GHSA-j548-68g5-9j7x", "packages": ["org.apache.activemq:apache-activemq", "org.apache.activemq:activemq-web-console"], "path": "advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json", "severity": "MODERATE", "status": "published", "summary": "Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting"}, {"advisory": "https://github.com/advisories/GHSA-mhp6-f224-j2c3", "aliases": ["CVE-2026-54475"], "commit": "https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json", "id": "GHSA-mhp6-f224-j2c3", "packages": ["org.apache.activemq:activemq-broker", "org.apache.activemq:activemq-all", "org.apache.activemq:apache-activemq"], "path": "advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json", "severity": "HIGH", "status": "published", "summary": "Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-rxjr-6c9q-h67x", "aliases": ["CVE-2026-63188"], "commit": "https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/08/GHSA-rxjr-6c9q-h67x/GHSA-rxjr-6c9q-h67x.json", "id": "GHSA-rxjr-6c9q-h67x", "packages": ["@logto/tunnel"], "path": "advisories/github-reviewed/2026/08/GHSA-rxjr-6c9q-h67x/GHSA-rxjr-6c9q-h67x.json", "severity": "HIGH", "status": "changed", "summary": "logto-tunnel serves files outside `--experience-path` via path traversal"}, {"advisory": "https://github.com/advisories/GHSA-hhf9-qw4v-72xp", "aliases": ["CVE-2026-12411"], "commit": "https://github.com/github/advisory-database/commit/ea5c37f32656932910a20139055ba87f3feabada", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/ea5c37f32656932910a20139055ba87f3feabada/advisories/github-reviewed/2026/11/GHSA-hhf9-qw4v-72xp/GHSA-hhf9-qw4v-72xp.json", "id": "GHSA-hhf9-qw4v-72xp", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-hhf9-qw4v-72xp/GHSA-hhf9-qw4v-72xp.json", "severity": "HIGH", "status": "published", "summary": "lxd allows Cross-guest volume hijack via DevLXD device patch"}, {"advisory": "https://github.com/advisories/GHSA-c9f5-j9c3-mhrg", "aliases": ["CVE-2026-55622"], "commit": "https://github.com/github/advisory-database/commit/c8e404abeae21b3533043f93aad3209f563804ee", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c8e404abeae21b3533043f93aad3209f563804ee/advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json", "id": "GHSA-c9f5-j9c3-mhrg", "packages": ["github.com/lxc/incus/v7/cmd/incusd", "github.com/lxc/incus", "github.com/lxc/incus/v6", "github.com/lxc/incus/v7"], "path": "advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json", "severity": "HIGH", "status": "changed", "summary": "Incus has a project restriction bypass in instance copy across projects"}, {"advisory": "https://github.com/advisories/GHSA-5q7h-w9jf-cx97", "aliases": ["CVE-2026-105769"], "commit": "https://github.com/github/advisory-database/commit/11e4da6bbb9646baa1b1b5637faaa51f28d89ee1", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/11e4da6bbb9646baa1b1b5637faaa51f28d89ee1/advisories/github-reviewed/2026/11/GHSA-5q7h-w9jf-cx97/GHSA-5q7h-w9jf-cx97.json", "id": "GHSA-5q7h-w9jf-cx97", "packages": ["github.com/chainguard-dev/kaniko"], "path": "advisories/github-reviewed/2026/11/GHSA-5q7h-w9jf-cx97/GHSA-5q7h-w9jf-cx97.json", "severity": "CRITICAL", "status": "published", "summary": "kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts"}, {"advisory": "https://github.com/advisories/GHSA-f2fc-vc88-6w7q", "aliases": ["CVE-2026-31862"], "commit": "https://github.com/github/advisory-database/commit/a15b10a067194389c69e2cbb263f71863a619102", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/a15b10a067194389c69e2cbb263f71863a619102/advisories/github-reviewed/2026/03/GHSA-f2fc-vc88-6w7q/GHSA-f2fc-vc88-6w7q.json", "id": "GHSA-f2fc-vc88-6w7q", "packages": ["@siteboon/claude-code-ui"], "path": "advisories/github-reviewed/2026/03/GHSA-f2fc-vc88-6w7q/GHSA-f2fc-vc88-6w7q.json", "severity": "CRITICAL", "status": "changed", "summary": "@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters"}, {"advisory": "https://github.com/advisories/GHSA-64vx-6h2c-rjh7", "aliases": ["CVE-2026-61536"], "commit": "https://github.com/github/advisory-database/commit/a15b10a067194389c69e2cbb263f71863a619102", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/a15b10a067194389c69e2cbb263f71863a619102/advisories/github-reviewed/2026/11/GHSA-64vx-6h2c-rjh7/GHSA-64vx-6h2c-rjh7.json", "id": "GHSA-64vx-6h2c-rjh7", "packages": ["banks"], "path": "advisories/github-reviewed/2026/11/GHSA-64vx-6h2c-rjh7/GHSA-64vx-6h2c-rjh7.json", "severity": "HIGH", "status": "published", "summary": "Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE"}, {"advisory": "https://github.com/advisories/GHSA-7ph3-grqh-pv9v", "aliases": ["CVE-2025-53648"], "commit": "https://github.com/github/advisory-database/commit/ed8973f214955efede5aaa44b424ffff995fe788", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/ed8973f214955efede5aaa44b424ffff995fe788/advisories/github-reviewed/2026/06/GHSA-7ph3-grqh-pv9v/GHSA-7ph3-grqh-pv9v.json", "id": "GHSA-7ph3-grqh-pv9v", "packages": ["org.apache.gravitino:catalog-jdbc-common"], "path": "advisories/github-reviewed/2026/06/GHSA-7ph3-grqh-pv9v/GHSA-7ph3-grqh-pv9v.json", "severity": "MODERATE", "status": "published", "summary": "Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation"}, {"advisory": "https://github.com/advisories/GHSA-m5ph-mmg5-6w5h", "aliases": ["CVE-2026-62300"], "commit": "https://github.com/github/advisory-database/commit/e907c7fd8845f48fe93445783d1b20c0cc128185", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/e907c7fd8845f48fe93445783d1b20c0cc128185/advisories/github-reviewed/2026/11/GHSA-m5ph-mmg5-6w5h/GHSA-m5ph-mmg5-6w5h.json", "id": "GHSA-m5ph-mmg5-6w5h", "packages": ["filecoin-pin"], "path": "advisories/github-reviewed/2026/11/GHSA-m5ph-mmg5-6w5h/GHSA-m5ph-mmg5-6w5h.json", "severity": "MODERATE", "status": "published", "summary": "filecoin-pin: Unbounded DAG pinning can exhaust server resources"}, {"advisory": "https://github.com/advisories/GHSA-cmxg-94mg-jq94", "aliases": ["CVE-2026-45325"], "commit": "https://github.com/github/advisory-database/commit/6d172d33d09e2e30f62cada7169acce533f3a939", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/6d172d33d09e2e30f62cada7169acce533f3a939/advisories/github-reviewed/2026/05/GHSA-cmxg-94mg-jq94/GHSA-cmxg-94mg-jq94.json", "id": "GHSA-cmxg-94mg-jq94", "packages": ["@tmlmobilidade/utils"], "path": "advisories/github-reviewed/2026/05/GHSA-cmxg-94mg-jq94/GHSA-cmxg-94mg-jq94.json", "severity": "HIGH", "status": "changed", "summary": "@tmlmobilidade/utils has prototype pollution in its setValueAtPath"}, {"advisory": "https://github.com/advisories/GHSA-hggm-x7r9-mm7v", "aliases": ["CVE-2026-32846"], "commit": "https://github.com/github/advisory-database/commit/8a02b848107f1d1bc75f077d96c09423d1d80890", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/8a02b848107f1d1bc75f077d96c09423d1d80890/advisories/github-reviewed/2026/03/GHSA-hggm-x7r9-mm7v/GHSA-hggm-x7r9-mm7v.json", "id": "GHSA-hggm-x7r9-mm7v", "packages": ["openclaw"], "path": "advisories/github-reviewed/2026/03/GHSA-hggm-x7r9-mm7v/GHSA-hggm-x7r9-mm7v.json", "severity": "HIGH", "status": "changed", "summary": "OpenClaw is vulnerable to Path Traversal through path validation bypass"}, {"advisory": "https://github.com/advisories/GHSA-3jp2-3mrg-2vxc", "aliases": ["CVE-2026-49272"], "commit": "https://github.com/github/advisory-database/commit/015b4ac6fc6c3d7a2e8cfe351f3d75c80fe5355c", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/015b4ac6fc6c3d7a2e8cfe351f3d75c80fe5355c/advisories/github-reviewed/2026/10/GHSA-3jp2-3mrg-2vxc/GHSA-3jp2-3mrg-2vxc.json", "id": "GHSA-3jp2-3mrg-2vxc", "packages": ["oauthlib"], "path": "advisories/github-reviewed/2026/10/GHSA-3jp2-3mrg-2vxc/GHSA-3jp2-3mrg-2vxc.json", "severity": "HIGH", "status": "changed", "summary": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow"}, {"advisory": "https://github.com/advisories/GHSA-gxp8-m5rq-3m38", "aliases": ["CVE-2025-11183"], "commit": "https://github.com/github/advisory-database/commit/2fd074d93c15dd5b3f942200aca4ab022c5940a8", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/2fd074d93c15dd5b3f942200aca4ab022c5940a8/advisories/github-reviewed/2025/10/GHSA-gxp8-m5rq-3m38/GHSA-gxp8-m5rq-3m38.json", "id": "GHSA-gxp8-m5rq-3m38", "packages": ["qwc2"], "path": "advisories/github-reviewed/2025/10/GHSA-gxp8-m5rq-3m38/GHSA-gxp8-m5rq-3m38.json", "severity": "MODERATE", "status": "changed", "summary": "QGIS QWC2 Cross-Site Scripting vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-2h2p-mvfx-868w", "aliases": ["CVE-2026-30869"], "commit": "https://github.com/github/advisory-database/commit/865ad3719da80c9fa4749db2ca509fc96c3ee201", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/865ad3719da80c9fa4749db2ca509fc96c3ee201/advisories/github-reviewed/2026/03/GHSA-2h2p-mvfx-868w/GHSA-2h2p-mvfx-868w.json", "id": "GHSA-2h2p-mvfx-868w", "packages": ["github.com/siyuan-note/siyuan/kernel"], "path": "advisories/github-reviewed/2026/03/GHSA-2h2p-mvfx-868w/GHSA-2h2p-mvfx-868w.json", "severity": "CRITICAL", "status": "changed", "summary": "SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage"}, {"advisory": "https://github.com/advisories/GHSA-3g9h-9hp4-654v", "aliases": ["CVE-2026-33203"], "commit": "https://github.com/github/advisory-database/commit/f1653eb81183a4d28ae04bdb386ee6f1edb45682", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/f1653eb81183a4d28ae04bdb386ee6f1edb45682/advisories/github-reviewed/2026/03/GHSA-3g9h-9hp4-654v/GHSA-3g9h-9hp4-654v.json", "id": "GHSA-3g9h-9hp4-654v", "packages": ["github.com/siyuan-note/siyuan/kernel"], "path": "advisories/github-reviewed/2026/03/GHSA-3g9h-9hp4-654v/GHSA-3g9h-9hp4-654v.json", "severity": "HIGH", "status": "changed", "summary": "SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass"}, {"advisory": "https://github.com/advisories/GHSA-4j3x-hhg2-fm2x", "aliases": ["CVE-2026-32704"], "commit": "https://github.com/github/advisory-database/commit/c8f7bc8c64a0164ad1d3cf7dd3f625fff5abb7d6", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c8f7bc8c64a0164ad1d3cf7dd3f625fff5abb7d6/advisories/github-reviewed/2026/03/GHSA-4j3x-hhg2-fm2x/GHSA-4j3x-hhg2-fm2x.json", "id": "GHSA-4j3x-hhg2-fm2x", "packages": ["github.com/siyuan-note/siyuan/kernel"], "path": "advisories/github-reviewed/2026/03/GHSA-4j3x-hhg2-fm2x/GHSA-4j3x-hhg2-fm2x.json", "severity": "MODERATE", "status": "changed", "summary": "SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB"}, {"advisory": "https://github.com/advisories/GHSA-56cv-c5p2-j2wg", "aliases": ["CVE-2026-32110"], "commit": "https://github.com/github/advisory-database/commit/3f84de2bbfab5e2cb56a797dc36ee60d378de9c4", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/3f84de2bbfab5e2cb56a797dc36ee60d378de9c4/advisories/github-reviewed/2026/03/GHSA-56cv-c5p2-j2wg/GHSA-56cv-c5p2-j2wg.json", "id": "GHSA-56cv-c5p2-j2wg", "packages": ["github.com/siyuan-note/siyuan/kernel"], "path": "advisories/github-reviewed/2026/03/GHSA-56cv-c5p2-j2wg/GHSA-56cv-c5p2-j2wg.json", "severity": "HIGH", "status": "changed", "summary": "SiYuan has a Full-Read SSRF via /api/network/forwardProxy"}, {"advisory": "https://github.com/advisories/GHSA-vm69-h85x-8p85", "aliases": ["CVE-2026-33194"], "commit": "https://github.com/github/advisory-database/commit/3c6eaabfbdde2e6a3b9d26701f3ce718f6f77267", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/3c6eaabfbdde2e6a3b9d26701f3ce718f6f77267/advisories/github-reviewed/2026/03/GHSA-vm69-h85x-8p85/GHSA-vm69-h85x-8p85.json", "id": "GHSA-vm69-h85x-8p85", "packages": ["github.com/siyuan-note/siyuan/kernel"], "path": "advisories/github-reviewed/2026/03/GHSA-vm69-h85x-8p85/GHSA-vm69-h85x-8p85.json", "severity": "MODERATE", "status": "changed", "summary": "SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)"}, {"advisory": "https://github.com/advisories/GHSA-xh5j-727m-w6gg", "aliases": ["CVE-2026-45061"], "commit": "https://github.com/github/advisory-database/commit/a078f9080b4bb1f9fcd3a8e04759dac640d7694a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/a078f9080b4bb1f9fcd3a8e04759dac640d7694a/advisories/github-reviewed/2026/05/GHSA-xh5j-727m-w6gg/GHSA-xh5j-727m-w6gg.json", "id": "GHSA-xh5j-727m-w6gg", "packages": ["budibase"], "path": "advisories/github-reviewed/2026/05/GHSA-xh5j-727m-w6gg/GHSA-xh5j-727m-w6gg.json", "severity": "HIGH", "status": "changed", "summary": "Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)"}, {"advisory": "https://github.com/advisories/GHSA-2cm2-m3w5-gp2f", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/05/GHSA-2cm2-m3w5-gp2f/GHSA-2cm2-m3w5-gp2f.json", "id": "GHSA-2cm2-m3w5-gp2f", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-2cm2-m3w5-gp2f/GHSA-2cm2-m3w5-gp2f.json", "severity": "MODERATE", "status": "changed", "summary": "vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`"}, {"advisory": "https://github.com/advisories/GHSA-c9f5-j9c3-mhrg", "aliases": ["CVE-2026-55622"], "commit": "https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json", "id": "GHSA-c9f5-j9c3-mhrg", "packages": ["github.com/lxc/incus/v7/cmd/incusd", "github.com/lxc/incus/v7"], "path": "advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json", "severity": "HIGH", "status": "changed", "summary": "Incus has a project restriction bypass in instance copy across projects"}, {"advisory": "https://github.com/advisories/GHSA-v5fq-cf5m-vwv7", "aliases": ["CVE-2026-33944"], "commit": "https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/10/GHSA-v5fq-cf5m-vwv7/GHSA-v5fq-cf5m-vwv7.json", "id": "GHSA-v5fq-cf5m-vwv7", "packages": ["dolibarr/dolibarr"], "path": "advisories/github-reviewed/2026/10/GHSA-v5fq-cf5m-vwv7/GHSA-v5fq-cf5m-vwv7.json", "severity": "HIGH", "status": "changed", "summary": "Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter"}, {"advisory": "https://github.com/advisories/GHSA-64f3-v33m-w89f", "aliases": ["CVE-2026-55621"], "commit": "https://github.com/github/advisory-database/commit/791a7d38dba2f98458199d10ad2cc55304c3d3d4", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/791a7d38dba2f98458199d10ad2cc55304c3d3d4/advisories/github-reviewed/2026/08/GHSA-64f3-v33m-w89f/GHSA-64f3-v33m-w89f.json", "id": "GHSA-64f3-v33m-w89f", "packages": ["github.com/lxc/incus/v7", "github.com/lxc/incus/v6", "github.com/lxc/incus"], "path": "advisories/github-reviewed/2026/08/GHSA-64f3-v33m-w89f/GHSA-64f3-v33m-w89f.json", "severity": "HIGH", "status": "changed", "summary": "Incus has a project restriction bypass for custom volume copy across projects"}, {"advisory": "https://github.com/advisories/GHSA-48q5-w887-33wv", "aliases": ["CVE-2026-48751"], "commit": "https://github.com/github/advisory-database/commit/9843e758d8a6bdf96faba4ba962bdf47011ee643", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/9843e758d8a6bdf96faba4ba962bdf47011ee643/advisories/github-reviewed/2026/06/GHSA-48q5-w887-33wv/GHSA-48q5-w887-33wv.json", "id": "GHSA-48q5-w887-33wv", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-48q5-w887-33wv/GHSA-48q5-w887-33wv.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has a restricted project bypass leading to arbitrary command execution"}, {"advisory": "https://github.com/advisories/GHSA-73hr-m85f-64v9", "aliases": ["CVE-2026-48750"], "commit": "https://github.com/github/advisory-database/commit/fec7032b5bb9f790a16067369a11e480722f4fb9", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/fec7032b5bb9f790a16067369a11e480722f4fb9/advisories/github-reviewed/2026/06/GHSA-73hr-m85f-64v9/GHSA-73hr-m85f-64v9.json", "id": "GHSA-73hr-m85f-64v9", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-73hr-m85f-64v9/GHSA-73hr-m85f-64v9.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has an arbitrary file write on host via `exec-output` symlink in crafted image"}, {"advisory": "https://github.com/advisories/GHSA-wp5r-2gw5-m7q7", "aliases": ["CVE-2026-44003"], "commit": "https://github.com/github/advisory-database/commit/39caaca4c1b43ae1b1b262f5e83159cbd9e145c3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/39caaca4c1b43ae1b1b262f5e83159cbd9e145c3/advisories/github-reviewed/2026/05/GHSA-wp5r-2gw5-m7q7/GHSA-wp5r-2gw5-m7q7.json", "id": "GHSA-wp5r-2gw5-m7q7", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/05/GHSA-wp5r-2gw5-m7q7/GHSA-wp5r-2gw5-m7q7.json", "severity": "MODERATE", "status": "changed", "summary": "vm2's Transformer Fast-Path Bypass Exposes Internal State Variable"}, {"advisory": "https://github.com/advisories/GHSA-m5w8-4gq2-6f8x", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/e6882087f0d73ac8d9d9fcad3b5371f5e2bbcd4e", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/e6882087f0d73ac8d9d9fcad3b5371f5e2bbcd4e/advisories/github-reviewed/2026/08/GHSA-m5w8-4gq2-6f8x/GHSA-m5w8-4gq2-6f8x.json", "id": "GHSA-m5w8-4gq2-6f8x", "packages": ["vm2"], "path": "advisories/github-reviewed/2026/08/GHSA-m5w8-4gq2-6f8x/GHSA-m5w8-4gq2-6f8x.json", "severity": "CRITICAL", "status": "changed", "summary": "vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` \u2014 process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)"}, {"advisory": "https://github.com/advisories/GHSA-45rp-9p97-h852", "aliases": ["CVE-2026-28399"], "commit": "https://github.com/github/advisory-database/commit/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878/advisories/github-reviewed/2026/03/GHSA-45rp-9p97-h852/GHSA-45rp-9p97-h852.json", "id": "GHSA-45rp-9p97-h852", "packages": ["nocodb"], "path": "advisories/github-reviewed/2026/03/GHSA-45rp-9p97-h852/GHSA-45rp-9p97-h852.json", "severity": "MODERATE", "status": "changed", "summary": "NocoDB Vulnerable to SQL Injection via DATEADD Formula"}, {"advisory": "https://github.com/advisories/GHSA-mpp2-x7wv-38hv", "aliases": ["CVE-2026-28360"], "commit": "https://github.com/github/advisory-database/commit/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878/advisories/github-reviewed/2026/03/GHSA-mpp2-x7wv-38hv/GHSA-mpp2-x7wv-38hv.json", "id": "GHSA-mpp2-x7wv-38hv", "packages": ["nocodb"], "path": "advisories/github-reviewed/2026/03/GHSA-mpp2-x7wv-38hv/GHSA-mpp2-x7wv-38hv.json", "severity": "LOW", "status": "changed", "summary": "NocoDB has Plaintext Storage of Shared View Passwords"}, {"advisory": "https://github.com/advisories/GHSA-p9x3-w98f-7j3q", "aliases": ["CVE-2026-28361"], "commit": "https://github.com/github/advisory-database/commit/2a4c7a05de1c8873ea59d5622dab0076bddc3957", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/2a4c7a05de1c8873ea59d5622dab0076bddc3957/advisories/github-reviewed/2026/03/GHSA-p9x3-w98f-7j3q/GHSA-p9x3-w98f-7j3q.json", "id": "GHSA-p9x3-w98f-7j3q", "packages": ["nocodb"], "path": "advisories/github-reviewed/2026/03/GHSA-p9x3-w98f-7j3q/GHSA-p9x3-w98f-7j3q.json", "severity": "MODERATE", "status": "changed", "summary": "NocoDB Missing Ownership Validation in MCP Token Operations"}, {"advisory": "https://github.com/advisories/GHSA-x4vh-j75g-268g", "aliases": ["CVE-2026-28396"], "commit": "https://github.com/github/advisory-database/commit/bf4213ab9f1b0ac55849e37db406cc43a18b86ff", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/bf4213ab9f1b0ac55849e37db406cc43a18b86ff/advisories/github-reviewed/2026/03/GHSA-x4vh-j75g-268g/GHSA-x4vh-j75g-268g.json", "id": "GHSA-x4vh-j75g-268g", "packages": ["nocodb"], "path": "advisories/github-reviewed/2026/03/GHSA-x4vh-j75g-268g/GHSA-x4vh-j75g-268g.json", "severity": "MODERATE", "status": "changed", "summary": "NocoDB's Refresh Tokens Not Revoked on Password Reset"}, {"advisory": "https://github.com/advisories/GHSA-7prp-2623-8g45", "aliases": ["CVE-2026-61599"], "commit": "https://github.com/github/advisory-database/commit/fb038a5ae11c8a0f19ea670ea43e0fffde2b53b3", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/fb038a5ae11c8a0f19ea670ea43e0fffde2b53b3/advisories/github-reviewed/2026/09/GHSA-7prp-2623-8g45/GHSA-7prp-2623-8g45.json", "id": "GHSA-7prp-2623-8g45", "packages": ["djust"], "path": "advisories/github-reviewed/2026/09/GHSA-7prp-2623-8g45/GHSA-7prp-2623-8g45.json", "severity": "HIGH", "status": "changed", "summary": "djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path"}, {"advisory": "https://github.com/advisories/GHSA-vxp5-584q-c479", "aliases": ["CVE-2026-48752"], "commit": "https://github.com/github/advisory-database/commit/4c4cdf40232626b41099bc618e36e4b1a18f2f01", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4c4cdf40232626b41099bc618e36e4b1a18f2f01/advisories/github-reviewed/2026/06/GHSA-vxp5-584q-c479/GHSA-vxp5-584q-c479.json", "id": "GHSA-vxp5-584q-c479", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-vxp5-584q-c479/GHSA-vxp5-584q-c479.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has arbitrary file read+write on host via templates/ symlink in malicious image"}, {"advisory": "https://github.com/advisories/GHSA-2q3f-q5pq-g8wv", "aliases": ["CVE-2026-48749"], "commit": "https://github.com/github/advisory-database/commit/4159cc452914e4c6a5796e300c17db0dc9c05736", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4159cc452914e4c6a5796e300c17db0dc9c05736/advisories/github-reviewed/2026/06/GHSA-2q3f-q5pq-g8wv/GHSA-2q3f-q5pq-g8wv.json", "id": "GHSA-2q3f-q5pq-g8wv", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-2q3f-q5pq-g8wv/GHSA-2q3f-q5pq-g8wv.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image"}, {"advisory": "https://github.com/advisories/GHSA-v6mj-8pf4-hhw4", "aliases": ["CVE-2026-48755"], "commit": "https://github.com/github/advisory-database/commit/4e9366c004761377a2fc3e1a09714405e2156140", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4e9366c004761377a2fc3e1a09714405e2156140/advisories/github-reviewed/2026/06/GHSA-v6mj-8pf4-hhw4/GHSA-v6mj-8pf4-hhw4.json", "id": "GHSA-v6mj-8pf4-hhw4", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-v6mj-8pf4-hhw4/GHSA-v6mj-8pf4-hhw4.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has an argument injection in backup compression algorithm leading to AFW and ACE"}, {"advisory": "https://github.com/advisories/GHSA-f6m5-xw2g-xc4x", "aliases": ["CVE-2026-48769"], "commit": "https://github.com/github/advisory-database/commit/c1e192becf23c40e09ea6cb0aac29ae7e195170f", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c1e192becf23c40e09ea6cb0aac29ae7e195170f/advisories/github-reviewed/2026/06/GHSA-f6m5-xw2g-xc4x/GHSA-f6m5-xw2g-xc4x.json", "id": "GHSA-f6m5-xw2g-xc4x", "packages": ["github.com/lxc/incus/v7/cmd/incusd"], "path": "advisories/github-reviewed/2026/06/GHSA-f6m5-xw2g-xc4x/GHSA-f6m5-xw2g-xc4x.json", "severity": "CRITICAL", "status": "changed", "summary": "Incus has an arbitrary file write on its client due to trusted image hash"}], "sourceId": "advisories-reviewed", "text": "On November 5, 2026, GitHub's security advisory list published 10 new advisories, changed 30, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 28132, "fingerprint": "ca1ce35f7943dc6abee438812e57095579cb62c8c6c004805a5f01a10a8c9f33", "url": "https://flarereef.flareforward.com/files/watch/ca1ce35f7943dc6abee438812e57095579cb62c8c6c004805a5f01a10a8c9f33.json"}}, "project": {"projectId": 20, "name": "Security advisories (GitHub reviewed)", "kind": "watch", "keeper": "GitHub", "jurisdiction": "", "markText": "GH", "shape": "", "what": "GitHub's security advisory list", "repoUrl": "https://github.com/github/advisory-database", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "chunk": "day"}, "date": "2026-11-06", "author": {"name": "Flare Reef watcher", "handle": "", "verified": false}}