{"note": {"noteId": 439, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0xeb4f743a461de6a4bb82688f6e1151926313127cd63a114f4cd33db7d1d0d55a", "content": "{\"counts\":{\"changed\":6,\"published\":18,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-06\",\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-07T01:06:41Z\",\"rows\":[{\"advisory\":\"https://github.com/advisories/GHSA-9qpr-vc49-hqg2\",\"aliases\":[\"CVE-2026-43978\"],\"commit\":\"https://github.com/github/advisory-database/commit/d8159cf6826589a2eb30a1bc4ee47167dfcdf867\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/d8159cf6826589a2eb30a1bc4ee47167dfcdf867/advisories/github-reviewed/2026/05/GHSA-9qpr-vc49-hqg2/GHSA-9qpr-vc49-hqg2.json\",\"id\":\"GHSA-9qpr-vc49-hqg2\",\"packages\":[\"wger\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-9qpr-vc49-hqg2/GHSA-9qpr-vc49-hqg2.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager\"},{\"advisory\":\"https://github.com/advisories/GHSA-9754-6rhw-gj3h\",\"aliases\":[\"CVE-2026-6658\"],\"commit\":\"https://github.com/github/advisory-database/commit/2abdc2fd6dbf6991dcfef305ca30ff247e33c6ac\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/2abdc2fd6dbf6991dcfef305ca30ff247e33c6ac/advisories/github-reviewed/2026/06/GHSA-9754-6rhw-gj3h/GHSA-9754-6rhw-gj3h.json\",\"id\":\"GHSA-9754-6rhw-gj3h\",\"packages\":[\"nbconvert\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-9754-6rhw-gj3h/GHSA-9754-6rhw-gj3h.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports\"},{\"advisory\":\"https://github.com/advisories/GHSA-jmqv-2mx7-544h\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/7303a461f21dd7385ee649343a982dcee1b23bfc\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/7303a461f21dd7385ee649343a982dcee1b23bfc/advisories/github-reviewed/2026/06/GHSA-jmqv-2mx7-544h/GHSA-jmqv-2mx7-544h.json\",\"id\":\"GHSA-jmqv-2mx7-544h\",\"packages\":[\"Magick.NET-Q16-AnyCPU\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-jmqv-2mx7-544h/GHSA-jmqv-2mx7-544h.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: ImageMagick: Malicious PCD files trigger 1\u2011byte heap Out-of-bounds Read and DoS\"},{\"advisory\":\"https://github.com/advisories/GHSA-wgxp-q8xq-wpp9\",\"aliases\":[\"CVE-2026-56378\"],\"commit\":\"https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/02/GHSA-wgxp-q8xq-wpp9/GHSA-wgxp-q8xq-wpp9.json\",\"id\":\"GHSA-wgxp-q8xq-wpp9\",\"packages\":[\"Magick.NET-Q16-AnyCPU\",\"Magick.NET-Q16-HDRI-AnyCPU\",\"Magick.NET-Q16-HDRI-OpenMP-arm64\",\"Magick.NET-Q16-HDRI-OpenMP-x64\",\"Magick.NET-Q16-HDRI-arm64\",\"Magick.NET-Q16-HDRI-x64\",\"Magick.NET-Q16-HDRI-x86\",\"Magick.NET-Q16-OpenMP-arm64\",\"Magick.NET-Q16-OpenMP-x64\",\"Magick.NET-Q16-OpenMP-x86\",\"Magick.NET-Q16-arm64\",\"Magick.NET-Q16-x64\",\"Magick.NET-Q16-x86\",\"Magick.NET-Q8-AnyCPU\",\"Magick.NET-Q8-OpenMP-arm64\",\"Magick.NET-Q8-OpenMP-x64\",\"Magick.NET-Q8-arm64\",\"Magick.NET-Q8-x64\",\"Magick.NET-Q8-x86\"],\"path\":\"advisories/github-reviewed/2026/02/GHSA-wgxp-q8xq-wpp9/GHSA-wgxp-q8xq-wpp9.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"ImageMagick: Malicious PCD files trigger 1\u2011byte heap Out-of-bounds Read and DoS \"},{\"advisory\":\"https://github.com/advisories/GHSA-f3j8-8ggq-f9x2\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/07/GHSA-f3j8-8ggq-f9x2/GHSA-f3j8-8ggq-f9x2.json\",\"id\":\"GHSA-f3j8-8ggq-f9x2\",\"packages\":[\"org.eclipse.hawkbit:hawkbit-ddi-resource\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-f3j8-8ggq-f9x2/GHSA-f3j8-8ggq-f9x2.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration\"},{\"advisory\":\"https://github.com/advisories/GHSA-92r3-p8c2-3fpx\",\"aliases\":[\"CVE-2026-16454\"],\"commit\":\"https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/11/GHSA-92r3-p8c2-3fpx/GHSA-92r3-p8c2-3fpx.json\",\"id\":\"GHSA-92r3-p8c2-3fpx\",\"packages\":[\"org.eclipse.hawkbit:hawkbit-ddi-resource\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-92r3-p8c2-3fpx/GHSA-92r3-p8c2-3fpx.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration\"},{\"advisory\":\"https://github.com/advisories/GHSA-5w5g-j6hw-6p8f\",\"aliases\":[\"CVE-2026-62284\"],\"commit\":\"https://github.com/github/advisory-database/commit/10513dddf0f482af42e8261be7ea71baca7d063e\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/10513dddf0f482af42e8261be7ea71baca7d063e/advisories/github-reviewed/2026/11/GHSA-5w5g-j6hw-6p8f/GHSA-5w5g-j6hw-6p8f.json\",\"id\":\"GHSA-5w5g-j6hw-6p8f\",\"packages\":[\"github.com/osac-project/osac-operator\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-5w5g-j6hw-6p8f/GHSA-5w5g-j6hw-6p8f.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy\"},{\"advisory\":\"https://github.com/advisories/GHSA-xgjr-7j9q-2h4r\",\"aliases\":[\"CVE-2026-62361\"],\"commit\":\"https://github.com/github/advisory-database/commit/505c16faeefc2c60dac1977526f063b4bf3dbaeb\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/505c16faeefc2c60dac1977526f063b4bf3dbaeb/advisories/github-reviewed/2026/11/GHSA-xgjr-7j9q-2h4r/GHSA-xgjr-7j9q-2h4r.json\",\"id\":\"GHSA-xgjr-7j9q-2h4r\",\"packages\":[\"github.com/knadh/listmonk\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-xgjr-7j9q-2h4r/GHSA-xgjr-7j9q-2h4r.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials\"},{\"advisory\":\"https://github.com/advisories/GHSA-3gq2-x4qg-p4g6\",\"aliases\":[\"CVE-2026-28385\"],\"commit\":\"https://github.com/github/advisory-database/commit/fcf0b93e2b616ad34bf93aa7785158a441b55ed2\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/fcf0b93e2b616ad34bf93aa7785158a441b55ed2/advisories/github-reviewed/2026/11/GHSA-3gq2-x4qg-p4g6/GHSA-3gq2-x4qg-p4g6.json\",\"id\":\"GHSA-3gq2-x4qg-p4g6\",\"packages\":[\"github.com/canonical/lxd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-3gq2-x4qg-p4g6/GHSA-3gq2-x4qg-p4g6.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"LXD: SSRF via image import from URL allows internal network probing by authenticated users\"},{\"advisory\":\"https://github.com/advisories/GHSA-cj9g-27ph-4cgv\",\"aliases\":[\"CVE-2026-43977\"],\"commit\":\"https://github.com/github/advisory-database/commit/1e11a8ef60c6edc18d40815f315106ebfda2ce00\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/1e11a8ef60c6edc18d40815f315106ebfda2ce00/advisories/github-reviewed/2026/05/GHSA-cj9g-27ph-4cgv/GHSA-cj9g-27ph-4cgv.json\",\"id\":\"GHSA-cj9g-27ph-4cgv\",\"packages\":[\"wger\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-cj9g-27ph-4cgv/GHSA-cj9g-27ph-4cgv.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API\"},{\"advisory\":\"https://github.com/advisories/GHSA-9j25-mm2h-2f76\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/5194356220262508faf3af7209007a06f7fe8f31\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/5194356220262508faf3af7209007a06f7fe8f31/advisories/github-reviewed/2026/11/GHSA-9j25-mm2h-2f76/GHSA-9j25-mm2h-2f76.json\",\"id\":\"GHSA-9j25-mm2h-2f76\",\"packages\":[\"github.com/canonical/lxd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-9j25-mm2h-2f76/GHSA-9j25-mm2h-2f76.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"LXD has arbitrary file write on host via `exec-output` symlink in crafted image\"},{\"advisory\":\"https://github.com/advisories/GHSA-jpf8-86f3-wp38\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/96f7f41801a86538b75b4bcc9eff62b1a76f6e1d\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/96f7f41801a86538b75b4bcc9eff62b1a76f6e1d/advisories/github-reviewed/2026/11/GHSA-jpf8-86f3-wp38/GHSA-jpf8-86f3-wp38.json\",\"id\":\"GHSA-jpf8-86f3-wp38\",\"packages\":[\"github.com/canonical/lxd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-jpf8-86f3-wp38/GHSA-jpf8-86f3-wp38.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"LXD has arbitrary file read+write on host via templates/ symlink in malicious image\"},{\"advisory\":\"https://github.com/advisories/GHSA-3x7p-v8hj-xh5m\",\"aliases\":[\"CVE-2026-45710\"],\"commit\":\"https://github.com/github/advisory-database/commit/9e79cd0d159720bd1dd99f7fde08642e2908f30f\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/9e79cd0d159720bd1dd99f7fde08642e2908f30f/advisories/github-reviewed/2026/07/GHSA-3x7p-v8hj-xh5m/GHSA-3x7p-v8hj-xh5m.json\",\"id\":\"GHSA-3x7p-v8hj-xh5m\",\"packages\":[\"facturascripts/facturascripts\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-3x7p-v8hj-xh5m/GHSA-3x7p-v8hj-xh5m.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`\"},{\"advisory\":\"https://github.com/advisories/GHSA-mxwc-wh95-pw4g\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/c6718f419947064fe70016c160d434677457d6d1\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/c6718f419947064fe70016c160d434677457d6d1/advisories/github-reviewed/2026/07/GHSA-mxwc-wh95-pw4g/GHSA-mxwc-wh95-pw4g.json\",\"id\":\"GHSA-mxwc-wh95-pw4g\",\"packages\":[\"trapster\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-mxwc-wh95-pw4g/GHSA-mxwc-wh95-pw4g.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler\"},{\"advisory\":\"https://github.com/advisories/GHSA-vghh-5rfx-xhq8\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/2957c4b6dbe5add45829f6ac802e9fb32a71920d\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/2957c4b6dbe5add45829f6ac802e9fb32a71920d/advisories/github-reviewed/2026/11/GHSA-vghh-5rfx-xhq8/GHSA-vghh-5rfx-xhq8.json\",\"id\":\"GHSA-vghh-5rfx-xhq8\",\"packages\":[\"github.com/canonical/lxd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-vghh-5rfx-xhq8/GHSA-vghh-5rfx-xhq8.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image\"},{\"advisory\":\"https://github.com/advisories/GHSA-9fpx-fr6j-2vh6\",\"aliases\":[\"CVE-2026-33050\"],\"commit\":\"https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-9fpx-fr6j-2vh6/GHSA-9fpx-fr6j-2vh6.json\",\"id\":\"GHSA-9fpx-fr6j-2vh6\",\"packages\":[\"GeoNode\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-9fpx-fr6j-2vh6/GHSA-9fpx-fr6j-2vh6.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"GeoNode has OS command injection via uploaded file layer name\"},{\"advisory\":\"https://github.com/advisories/GHSA-fmc8-p6q7-75cc\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-fmc8-p6q7-75cc/GHSA-fmc8-p6q7-75cc.json\",\"id\":\"GHSA-fmc8-p6q7-75cc\",\"packages\":[\"github.com/canonical/lxd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-fmc8-p6q7-75cc/GHSA-fmc8-p6q7-75cc.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"LXD has argument injection in backup compression algorithm leading to AFW and ACE\"},{\"advisory\":\"https://github.com/advisories/GHSA-j93m-3j9p-m5m8\",\"aliases\":[\"CVE-2026-9639\"],\"commit\":\"https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-j93m-3j9p-m5m8/GHSA-j93m-3j9p-m5m8.json\",\"id\":\"GHSA-j93m-3j9p-m5m8\",\"packages\":[\"github.com/canonical/lxd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-j93m-3j9p-m5m8/GHSA-j93m-3j9p-m5m8.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at\"},{\"advisory\":\"https://github.com/advisories/GHSA-pjff-c2wc-f6jm\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-pjff-c2wc-f6jm/GHSA-pjff-c2wc-f6jm.json\",\"id\":\"GHSA-pjff-c2wc-f6jm\",\"packages\":[\"github.com/canonical/lxd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-pjff-c2wc-f6jm/GHSA-pjff-c2wc-f6jm.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"LXD has arbitrary file write on client due to trusted image hash\"},{\"advisory\":\"https://github.com/advisories/GHSA-fqpv-mq26-pr4j\",\"aliases\":[\"CVE-2026-46429\"],\"commit\":\"https://github.com/github/advisory-database/commit/53f590f0eb6b365dd5bf54f8a077b1e0352e8252\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/53f590f0eb6b365dd5bf54f8a077b1e0352e8252/advisories/github-reviewed/2026/11/GHSA-fqpv-mq26-pr4j/GHSA-fqpv-mq26-pr4j.json\",\"id\":\"GHSA-fqpv-mq26-pr4j\",\"packages\":[\"GeoNode\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-fqpv-mq26-pr4j/GHSA-fqpv-mq26-pr4j.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"GeoNode has Unrestricted File Upload\"},{\"advisory\":\"https://github.com/advisories/GHSA-r4hm-p9f9-fj9v\",\"aliases\":[\"CVE-2026-55649\"],\"commit\":\"https://github.com/github/advisory-database/commit/0d413bb2a07b6216969b5a0ab87b2b6bc37eee83\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/0d413bb2a07b6216969b5a0ab87b2b6bc37eee83/advisories/github-reviewed/2026/11/GHSA-r4hm-p9f9-fj9v/GHSA-r4hm-p9f9-fj9v.json\",\"id\":\"GHSA-r4hm-p9f9-fj9v\",\"packages\":[\"GeoNode\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-r4hm-p9f9-fj9v/GHSA-r4hm-p9f9-fj9v.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"GeoNode has Stored XSS in Documents metadata abstract field\"},{\"advisory\":\"https://github.com/advisories/GHSA-47w9-6r3f-938g\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-47w9-6r3f-938g/GHSA-47w9-6r3f-938g.json\",\"id\":\"GHSA-47w9-6r3f-938g\",\"packages\":[\"github.com/canonical/lxd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-47w9-6r3f-938g/GHSA-47w9-6r3f-938g.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"LXD has restricted project bypass leading to arbitrary command execution\"},{\"advisory\":\"https://github.com/advisories/GHSA-7mr3-28h5-m5vx\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-7mr3-28h5-m5vx/GHSA-7mr3-28h5-m5vx.json\",\"id\":\"GHSA-7mr3-28h5-m5vx\",\"packages\":[\"github.com/canonical/lxd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-7mr3-28h5-m5vx/GHSA-7mr3-28h5-m5vx.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"LXD has project restriction bypass for custom volume copy across projects \"},{\"advisory\":\"https://github.com/advisories/GHSA-qx75-2p3r-pwm5\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-qx75-2p3r-pwm5/GHSA-qx75-2p3r-pwm5.json\",\"id\":\"GHSA-qx75-2p3r-pwm5\",\"packages\":[\"github.com/canonical/lxd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-qx75-2p3r-pwm5/GHSA-qx75-2p3r-pwm5.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"LXD has project restriction bypass in instance copy across projects \"}],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 6, 2026, GitHub's security advisory list published 18 new advisories, changed 6, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "", "txHash": "0xdcb615e8b8a796dcb3f972f8c72c7dc70a53ae8a2995d9a035e38d8648ccc9a6", "receiptUrl": "https://flare-explorer.flare.network/tx/0xdcb615e8b8a796dcb3f972f8c72c7dc70a53ae8a2995d9a035e38d8648ccc9a6", "blockNumber": 73927880, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": [], "parsed": {"counts": {"changed": 6, "published": 18, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-06", "kind": "watch-day", "recordedAt": "2026-11-07T01:06:41Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-9qpr-vc49-hqg2", "aliases": ["CVE-2026-43978"], "commit": "https://github.com/github/advisory-database/commit/d8159cf6826589a2eb30a1bc4ee47167dfcdf867", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/d8159cf6826589a2eb30a1bc4ee47167dfcdf867/advisories/github-reviewed/2026/05/GHSA-9qpr-vc49-hqg2/GHSA-9qpr-vc49-hqg2.json", "id": "GHSA-9qpr-vc49-hqg2", "packages": ["wger"], "path": "advisories/github-reviewed/2026/05/GHSA-9qpr-vc49-hqg2/GHSA-9qpr-vc49-hqg2.json", "severity": "HIGH", "status": "changed", "summary": "wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager"}, {"advisory": "https://github.com/advisories/GHSA-9754-6rhw-gj3h", "aliases": ["CVE-2026-6658"], "commit": "https://github.com/github/advisory-database/commit/2abdc2fd6dbf6991dcfef305ca30ff247e33c6ac", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/2abdc2fd6dbf6991dcfef305ca30ff247e33c6ac/advisories/github-reviewed/2026/06/GHSA-9754-6rhw-gj3h/GHSA-9754-6rhw-gj3h.json", "id": "GHSA-9754-6rhw-gj3h", "packages": ["nbconvert"], "path": "advisories/github-reviewed/2026/06/GHSA-9754-6rhw-gj3h/GHSA-9754-6rhw-gj3h.json", "severity": "MODERATE", "status": "changed", "summary": "jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports"}, {"advisory": "https://github.com/advisories/GHSA-jmqv-2mx7-544h", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/7303a461f21dd7385ee649343a982dcee1b23bfc", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/7303a461f21dd7385ee649343a982dcee1b23bfc/advisories/github-reviewed/2026/06/GHSA-jmqv-2mx7-544h/GHSA-jmqv-2mx7-544h.json", "id": "GHSA-jmqv-2mx7-544h", "packages": ["Magick.NET-Q16-AnyCPU"], "path": "advisories/github-reviewed/2026/06/GHSA-jmqv-2mx7-544h/GHSA-jmqv-2mx7-544h.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: ImageMagick: Malicious PCD files trigger 1\u2011byte heap Out-of-bounds Read and DoS"}, {"advisory": "https://github.com/advisories/GHSA-wgxp-q8xq-wpp9", "aliases": ["CVE-2026-56378"], "commit": "https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/02/GHSA-wgxp-q8xq-wpp9/GHSA-wgxp-q8xq-wpp9.json", "id": "GHSA-wgxp-q8xq-wpp9", "packages": ["Magick.NET-Q16-AnyCPU", "Magick.NET-Q16-HDRI-AnyCPU", "Magick.NET-Q16-HDRI-OpenMP-arm64", "Magick.NET-Q16-HDRI-OpenMP-x64", "Magick.NET-Q16-HDRI-arm64", "Magick.NET-Q16-HDRI-x64", "Magick.NET-Q16-HDRI-x86", "Magick.NET-Q16-OpenMP-arm64", "Magick.NET-Q16-OpenMP-x64", "Magick.NET-Q16-OpenMP-x86", "Magick.NET-Q16-arm64", "Magick.NET-Q16-x64", "Magick.NET-Q16-x86", "Magick.NET-Q8-AnyCPU", "Magick.NET-Q8-OpenMP-arm64", "Magick.NET-Q8-OpenMP-x64", "Magick.NET-Q8-arm64", "Magick.NET-Q8-x64", "Magick.NET-Q8-x86"], "path": "advisories/github-reviewed/2026/02/GHSA-wgxp-q8xq-wpp9/GHSA-wgxp-q8xq-wpp9.json", "severity": "MODERATE", "status": "changed", "summary": "ImageMagick: Malicious PCD files trigger 1\u2011byte heap Out-of-bounds Read and DoS "}, {"advisory": "https://github.com/advisories/GHSA-f3j8-8ggq-f9x2", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/07/GHSA-f3j8-8ggq-f9x2/GHSA-f3j8-8ggq-f9x2.json", "id": "GHSA-f3j8-8ggq-f9x2", "packages": ["org.eclipse.hawkbit:hawkbit-ddi-resource"], "path": "advisories/github-reviewed/2026/07/GHSA-f3j8-8ggq-f9x2/GHSA-f3j8-8ggq-f9x2.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration"}, {"advisory": "https://github.com/advisories/GHSA-92r3-p8c2-3fpx", "aliases": ["CVE-2026-16454"], "commit": "https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/11/GHSA-92r3-p8c2-3fpx/GHSA-92r3-p8c2-3fpx.json", "id": "GHSA-92r3-p8c2-3fpx", "packages": ["org.eclipse.hawkbit:hawkbit-ddi-resource"], "path": "advisories/github-reviewed/2026/11/GHSA-92r3-p8c2-3fpx/GHSA-92r3-p8c2-3fpx.json", "severity": "MODERATE", "status": "published", "summary": "Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration"}, {"advisory": "https://github.com/advisories/GHSA-5w5g-j6hw-6p8f", "aliases": ["CVE-2026-62284"], "commit": "https://github.com/github/advisory-database/commit/10513dddf0f482af42e8261be7ea71baca7d063e", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/10513dddf0f482af42e8261be7ea71baca7d063e/advisories/github-reviewed/2026/11/GHSA-5w5g-j6hw-6p8f/GHSA-5w5g-j6hw-6p8f.json", "id": "GHSA-5w5g-j6hw-6p8f", "packages": ["github.com/osac-project/osac-operator"], "path": "advisories/github-reviewed/2026/11/GHSA-5w5g-j6hw-6p8f/GHSA-5w5g-j6hw-6p8f.json", "severity": "HIGH", "status": "published", "summary": "OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy"}, {"advisory": "https://github.com/advisories/GHSA-xgjr-7j9q-2h4r", "aliases": ["CVE-2026-62361"], "commit": "https://github.com/github/advisory-database/commit/505c16faeefc2c60dac1977526f063b4bf3dbaeb", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/505c16faeefc2c60dac1977526f063b4bf3dbaeb/advisories/github-reviewed/2026/11/GHSA-xgjr-7j9q-2h4r/GHSA-xgjr-7j9q-2h4r.json", "id": "GHSA-xgjr-7j9q-2h4r", "packages": ["github.com/knadh/listmonk"], "path": "advisories/github-reviewed/2026/11/GHSA-xgjr-7j9q-2h4r/GHSA-xgjr-7j9q-2h4r.json", "severity": "MODERATE", "status": "published", "summary": "listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials"}, {"advisory": "https://github.com/advisories/GHSA-3gq2-x4qg-p4g6", "aliases": ["CVE-2026-28385"], "commit": "https://github.com/github/advisory-database/commit/fcf0b93e2b616ad34bf93aa7785158a441b55ed2", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/fcf0b93e2b616ad34bf93aa7785158a441b55ed2/advisories/github-reviewed/2026/11/GHSA-3gq2-x4qg-p4g6/GHSA-3gq2-x4qg-p4g6.json", "id": "GHSA-3gq2-x4qg-p4g6", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-3gq2-x4qg-p4g6/GHSA-3gq2-x4qg-p4g6.json", "severity": "MODERATE", "status": "published", "summary": "LXD: SSRF via image import from URL allows internal network probing by authenticated users"}, {"advisory": "https://github.com/advisories/GHSA-cj9g-27ph-4cgv", "aliases": ["CVE-2026-43977"], "commit": "https://github.com/github/advisory-database/commit/1e11a8ef60c6edc18d40815f315106ebfda2ce00", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/1e11a8ef60c6edc18d40815f315106ebfda2ce00/advisories/github-reviewed/2026/05/GHSA-cj9g-27ph-4cgv/GHSA-cj9g-27ph-4cgv.json", "id": "GHSA-cj9g-27ph-4cgv", "packages": ["wger"], "path": "advisories/github-reviewed/2026/05/GHSA-cj9g-27ph-4cgv/GHSA-cj9g-27ph-4cgv.json", "severity": "HIGH", "status": "changed", "summary": "wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API"}, {"advisory": "https://github.com/advisories/GHSA-9j25-mm2h-2f76", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/5194356220262508faf3af7209007a06f7fe8f31", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/5194356220262508faf3af7209007a06f7fe8f31/advisories/github-reviewed/2026/11/GHSA-9j25-mm2h-2f76/GHSA-9j25-mm2h-2f76.json", "id": "GHSA-9j25-mm2h-2f76", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-9j25-mm2h-2f76/GHSA-9j25-mm2h-2f76.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has arbitrary file write on host via `exec-output` symlink in crafted image"}, {"advisory": "https://github.com/advisories/GHSA-jpf8-86f3-wp38", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/96f7f41801a86538b75b4bcc9eff62b1a76f6e1d", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/96f7f41801a86538b75b4bcc9eff62b1a76f6e1d/advisories/github-reviewed/2026/11/GHSA-jpf8-86f3-wp38/GHSA-jpf8-86f3-wp38.json", "id": "GHSA-jpf8-86f3-wp38", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-jpf8-86f3-wp38/GHSA-jpf8-86f3-wp38.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has arbitrary file read+write on host via templates/ symlink in malicious image"}, {"advisory": "https://github.com/advisories/GHSA-3x7p-v8hj-xh5m", "aliases": ["CVE-2026-45710"], "commit": "https://github.com/github/advisory-database/commit/9e79cd0d159720bd1dd99f7fde08642e2908f30f", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/9e79cd0d159720bd1dd99f7fde08642e2908f30f/advisories/github-reviewed/2026/07/GHSA-3x7p-v8hj-xh5m/GHSA-3x7p-v8hj-xh5m.json", "id": "GHSA-3x7p-v8hj-xh5m", "packages": ["facturascripts/facturascripts"], "path": "advisories/github-reviewed/2026/07/GHSA-3x7p-v8hj-xh5m/GHSA-3x7p-v8hj-xh5m.json", "severity": "LOW", "status": "changed", "summary": "FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`"}, {"advisory": "https://github.com/advisories/GHSA-mxwc-wh95-pw4g", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/c6718f419947064fe70016c160d434677457d6d1", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/c6718f419947064fe70016c160d434677457d6d1/advisories/github-reviewed/2026/07/GHSA-mxwc-wh95-pw4g/GHSA-mxwc-wh95-pw4g.json", "id": "GHSA-mxwc-wh95-pw4g", "packages": ["trapster"], "path": "advisories/github-reviewed/2026/07/GHSA-mxwc-wh95-pw4g/GHSA-mxwc-wh95-pw4g.json", "severity": "MODERATE", "status": "changed", "summary": "Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler"}, {"advisory": "https://github.com/advisories/GHSA-vghh-5rfx-xhq8", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/2957c4b6dbe5add45829f6ac802e9fb32a71920d", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2957c4b6dbe5add45829f6ac802e9fb32a71920d/advisories/github-reviewed/2026/11/GHSA-vghh-5rfx-xhq8/GHSA-vghh-5rfx-xhq8.json", "id": "GHSA-vghh-5rfx-xhq8", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-vghh-5rfx-xhq8/GHSA-vghh-5rfx-xhq8.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image"}, {"advisory": "https://github.com/advisories/GHSA-9fpx-fr6j-2vh6", "aliases": ["CVE-2026-33050"], "commit": "https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-9fpx-fr6j-2vh6/GHSA-9fpx-fr6j-2vh6.json", "id": "GHSA-9fpx-fr6j-2vh6", "packages": ["GeoNode"], "path": "advisories/github-reviewed/2026/11/GHSA-9fpx-fr6j-2vh6/GHSA-9fpx-fr6j-2vh6.json", "severity": "HIGH", "status": "published", "summary": "GeoNode has OS command injection via uploaded file layer name"}, {"advisory": "https://github.com/advisories/GHSA-fmc8-p6q7-75cc", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-fmc8-p6q7-75cc/GHSA-fmc8-p6q7-75cc.json", "id": "GHSA-fmc8-p6q7-75cc", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-fmc8-p6q7-75cc/GHSA-fmc8-p6q7-75cc.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has argument injection in backup compression algorithm leading to AFW and ACE"}, {"advisory": "https://github.com/advisories/GHSA-j93m-3j9p-m5m8", "aliases": ["CVE-2026-9639"], "commit": "https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-j93m-3j9p-m5m8/GHSA-j93m-3j9p-m5m8.json", "id": "GHSA-j93m-3j9p-m5m8", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-j93m-3j9p-m5m8/GHSA-j93m-3j9p-m5m8.json", "severity": "MODERATE", "status": "published", "summary": "LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at"}, {"advisory": "https://github.com/advisories/GHSA-pjff-c2wc-f6jm", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-pjff-c2wc-f6jm/GHSA-pjff-c2wc-f6jm.json", "id": "GHSA-pjff-c2wc-f6jm", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-pjff-c2wc-f6jm/GHSA-pjff-c2wc-f6jm.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has arbitrary file write on client due to trusted image hash"}, {"advisory": "https://github.com/advisories/GHSA-fqpv-mq26-pr4j", "aliases": ["CVE-2026-46429"], "commit": "https://github.com/github/advisory-database/commit/53f590f0eb6b365dd5bf54f8a077b1e0352e8252", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/53f590f0eb6b365dd5bf54f8a077b1e0352e8252/advisories/github-reviewed/2026/11/GHSA-fqpv-mq26-pr4j/GHSA-fqpv-mq26-pr4j.json", "id": "GHSA-fqpv-mq26-pr4j", "packages": ["GeoNode"], "path": "advisories/github-reviewed/2026/11/GHSA-fqpv-mq26-pr4j/GHSA-fqpv-mq26-pr4j.json", "severity": "MODERATE", "status": "published", "summary": "GeoNode has Unrestricted File Upload"}, {"advisory": "https://github.com/advisories/GHSA-r4hm-p9f9-fj9v", "aliases": ["CVE-2026-55649"], "commit": "https://github.com/github/advisory-database/commit/0d413bb2a07b6216969b5a0ab87b2b6bc37eee83", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/0d413bb2a07b6216969b5a0ab87b2b6bc37eee83/advisories/github-reviewed/2026/11/GHSA-r4hm-p9f9-fj9v/GHSA-r4hm-p9f9-fj9v.json", "id": "GHSA-r4hm-p9f9-fj9v", "packages": ["GeoNode"], "path": "advisories/github-reviewed/2026/11/GHSA-r4hm-p9f9-fj9v/GHSA-r4hm-p9f9-fj9v.json", "severity": "MODERATE", "status": "published", "summary": "GeoNode has Stored XSS in Documents metadata abstract field"}, {"advisory": "https://github.com/advisories/GHSA-47w9-6r3f-938g", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-47w9-6r3f-938g/GHSA-47w9-6r3f-938g.json", "id": "GHSA-47w9-6r3f-938g", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-47w9-6r3f-938g/GHSA-47w9-6r3f-938g.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has restricted project bypass leading to arbitrary command execution"}, {"advisory": "https://github.com/advisories/GHSA-7mr3-28h5-m5vx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-7mr3-28h5-m5vx/GHSA-7mr3-28h5-m5vx.json", "id": "GHSA-7mr3-28h5-m5vx", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-7mr3-28h5-m5vx/GHSA-7mr3-28h5-m5vx.json", "severity": "HIGH", "status": "published", "summary": "LXD has project restriction bypass for custom volume copy across projects "}, {"advisory": "https://github.com/advisories/GHSA-qx75-2p3r-pwm5", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-qx75-2p3r-pwm5/GHSA-qx75-2p3r-pwm5.json", "id": "GHSA-qx75-2p3r-pwm5", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-qx75-2p3r-pwm5/GHSA-qx75-2p3r-pwm5.json", "severity": "HIGH", "status": "published", "summary": "LXD has project restriction bypass in instance copy across projects "}], "sourceId": "advisories-reviewed", "text": "On November 6, 2026, GitHub's security advisory list published 18 new advisories, changed 6, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1}}, "parsed": {"counts": {"changed": 6, "published": 18, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-06", "kind": "watch-day", "recordedAt": "2026-11-07T01:06:41Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-9qpr-vc49-hqg2", "aliases": ["CVE-2026-43978"], "commit": "https://github.com/github/advisory-database/commit/d8159cf6826589a2eb30a1bc4ee47167dfcdf867", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/d8159cf6826589a2eb30a1bc4ee47167dfcdf867/advisories/github-reviewed/2026/05/GHSA-9qpr-vc49-hqg2/GHSA-9qpr-vc49-hqg2.json", "id": "GHSA-9qpr-vc49-hqg2", "packages": ["wger"], "path": "advisories/github-reviewed/2026/05/GHSA-9qpr-vc49-hqg2/GHSA-9qpr-vc49-hqg2.json", "severity": "HIGH", "status": "changed", "summary": "wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager"}, {"advisory": "https://github.com/advisories/GHSA-9754-6rhw-gj3h", "aliases": ["CVE-2026-6658"], "commit": "https://github.com/github/advisory-database/commit/2abdc2fd6dbf6991dcfef305ca30ff247e33c6ac", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/2abdc2fd6dbf6991dcfef305ca30ff247e33c6ac/advisories/github-reviewed/2026/06/GHSA-9754-6rhw-gj3h/GHSA-9754-6rhw-gj3h.json", "id": "GHSA-9754-6rhw-gj3h", "packages": ["nbconvert"], "path": "advisories/github-reviewed/2026/06/GHSA-9754-6rhw-gj3h/GHSA-9754-6rhw-gj3h.json", "severity": "MODERATE", "status": "changed", "summary": "jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports"}, {"advisory": "https://github.com/advisories/GHSA-jmqv-2mx7-544h", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/7303a461f21dd7385ee649343a982dcee1b23bfc", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/7303a461f21dd7385ee649343a982dcee1b23bfc/advisories/github-reviewed/2026/06/GHSA-jmqv-2mx7-544h/GHSA-jmqv-2mx7-544h.json", "id": "GHSA-jmqv-2mx7-544h", "packages": ["Magick.NET-Q16-AnyCPU"], "path": "advisories/github-reviewed/2026/06/GHSA-jmqv-2mx7-544h/GHSA-jmqv-2mx7-544h.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: ImageMagick: Malicious PCD files trigger 1\u2011byte heap Out-of-bounds Read and DoS"}, {"advisory": "https://github.com/advisories/GHSA-wgxp-q8xq-wpp9", "aliases": ["CVE-2026-56378"], "commit": "https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/02/GHSA-wgxp-q8xq-wpp9/GHSA-wgxp-q8xq-wpp9.json", "id": "GHSA-wgxp-q8xq-wpp9", "packages": ["Magick.NET-Q16-AnyCPU", "Magick.NET-Q16-HDRI-AnyCPU", "Magick.NET-Q16-HDRI-OpenMP-arm64", "Magick.NET-Q16-HDRI-OpenMP-x64", "Magick.NET-Q16-HDRI-arm64", "Magick.NET-Q16-HDRI-x64", "Magick.NET-Q16-HDRI-x86", "Magick.NET-Q16-OpenMP-arm64", "Magick.NET-Q16-OpenMP-x64", "Magick.NET-Q16-OpenMP-x86", "Magick.NET-Q16-arm64", "Magick.NET-Q16-x64", "Magick.NET-Q16-x86", "Magick.NET-Q8-AnyCPU", "Magick.NET-Q8-OpenMP-arm64", "Magick.NET-Q8-OpenMP-x64", "Magick.NET-Q8-arm64", "Magick.NET-Q8-x64", "Magick.NET-Q8-x86"], "path": "advisories/github-reviewed/2026/02/GHSA-wgxp-q8xq-wpp9/GHSA-wgxp-q8xq-wpp9.json", "severity": "MODERATE", "status": "changed", "summary": "ImageMagick: Malicious PCD files trigger 1\u2011byte heap Out-of-bounds Read and DoS "}, {"advisory": "https://github.com/advisories/GHSA-f3j8-8ggq-f9x2", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/07/GHSA-f3j8-8ggq-f9x2/GHSA-f3j8-8ggq-f9x2.json", "id": "GHSA-f3j8-8ggq-f9x2", "packages": ["org.eclipse.hawkbit:hawkbit-ddi-resource"], "path": "advisories/github-reviewed/2026/07/GHSA-f3j8-8ggq-f9x2/GHSA-f3j8-8ggq-f9x2.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration"}, {"advisory": "https://github.com/advisories/GHSA-92r3-p8c2-3fpx", "aliases": ["CVE-2026-16454"], "commit": "https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/11/GHSA-92r3-p8c2-3fpx/GHSA-92r3-p8c2-3fpx.json", "id": "GHSA-92r3-p8c2-3fpx", "packages": ["org.eclipse.hawkbit:hawkbit-ddi-resource"], "path": "advisories/github-reviewed/2026/11/GHSA-92r3-p8c2-3fpx/GHSA-92r3-p8c2-3fpx.json", "severity": "MODERATE", "status": "published", "summary": "Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration"}, {"advisory": "https://github.com/advisories/GHSA-5w5g-j6hw-6p8f", "aliases": ["CVE-2026-62284"], "commit": "https://github.com/github/advisory-database/commit/10513dddf0f482af42e8261be7ea71baca7d063e", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/10513dddf0f482af42e8261be7ea71baca7d063e/advisories/github-reviewed/2026/11/GHSA-5w5g-j6hw-6p8f/GHSA-5w5g-j6hw-6p8f.json", "id": "GHSA-5w5g-j6hw-6p8f", "packages": ["github.com/osac-project/osac-operator"], "path": "advisories/github-reviewed/2026/11/GHSA-5w5g-j6hw-6p8f/GHSA-5w5g-j6hw-6p8f.json", "severity": "HIGH", "status": "published", "summary": "OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy"}, {"advisory": "https://github.com/advisories/GHSA-xgjr-7j9q-2h4r", "aliases": ["CVE-2026-62361"], "commit": "https://github.com/github/advisory-database/commit/505c16faeefc2c60dac1977526f063b4bf3dbaeb", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/505c16faeefc2c60dac1977526f063b4bf3dbaeb/advisories/github-reviewed/2026/11/GHSA-xgjr-7j9q-2h4r/GHSA-xgjr-7j9q-2h4r.json", "id": "GHSA-xgjr-7j9q-2h4r", "packages": ["github.com/knadh/listmonk"], "path": "advisories/github-reviewed/2026/11/GHSA-xgjr-7j9q-2h4r/GHSA-xgjr-7j9q-2h4r.json", "severity": "MODERATE", "status": "published", "summary": "listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials"}, {"advisory": "https://github.com/advisories/GHSA-3gq2-x4qg-p4g6", "aliases": ["CVE-2026-28385"], "commit": "https://github.com/github/advisory-database/commit/fcf0b93e2b616ad34bf93aa7785158a441b55ed2", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/fcf0b93e2b616ad34bf93aa7785158a441b55ed2/advisories/github-reviewed/2026/11/GHSA-3gq2-x4qg-p4g6/GHSA-3gq2-x4qg-p4g6.json", "id": "GHSA-3gq2-x4qg-p4g6", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-3gq2-x4qg-p4g6/GHSA-3gq2-x4qg-p4g6.json", "severity": "MODERATE", "status": "published", "summary": "LXD: SSRF via image import from URL allows internal network probing by authenticated users"}, {"advisory": "https://github.com/advisories/GHSA-cj9g-27ph-4cgv", "aliases": ["CVE-2026-43977"], "commit": "https://github.com/github/advisory-database/commit/1e11a8ef60c6edc18d40815f315106ebfda2ce00", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/1e11a8ef60c6edc18d40815f315106ebfda2ce00/advisories/github-reviewed/2026/05/GHSA-cj9g-27ph-4cgv/GHSA-cj9g-27ph-4cgv.json", "id": "GHSA-cj9g-27ph-4cgv", "packages": ["wger"], "path": "advisories/github-reviewed/2026/05/GHSA-cj9g-27ph-4cgv/GHSA-cj9g-27ph-4cgv.json", "severity": "HIGH", "status": "changed", "summary": "wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API"}, {"advisory": "https://github.com/advisories/GHSA-9j25-mm2h-2f76", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/5194356220262508faf3af7209007a06f7fe8f31", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/5194356220262508faf3af7209007a06f7fe8f31/advisories/github-reviewed/2026/11/GHSA-9j25-mm2h-2f76/GHSA-9j25-mm2h-2f76.json", "id": "GHSA-9j25-mm2h-2f76", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-9j25-mm2h-2f76/GHSA-9j25-mm2h-2f76.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has arbitrary file write on host via `exec-output` symlink in crafted image"}, {"advisory": "https://github.com/advisories/GHSA-jpf8-86f3-wp38", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/96f7f41801a86538b75b4bcc9eff62b1a76f6e1d", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/96f7f41801a86538b75b4bcc9eff62b1a76f6e1d/advisories/github-reviewed/2026/11/GHSA-jpf8-86f3-wp38/GHSA-jpf8-86f3-wp38.json", "id": "GHSA-jpf8-86f3-wp38", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-jpf8-86f3-wp38/GHSA-jpf8-86f3-wp38.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has arbitrary file read+write on host via templates/ symlink in malicious image"}, {"advisory": "https://github.com/advisories/GHSA-3x7p-v8hj-xh5m", "aliases": ["CVE-2026-45710"], "commit": "https://github.com/github/advisory-database/commit/9e79cd0d159720bd1dd99f7fde08642e2908f30f", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/9e79cd0d159720bd1dd99f7fde08642e2908f30f/advisories/github-reviewed/2026/07/GHSA-3x7p-v8hj-xh5m/GHSA-3x7p-v8hj-xh5m.json", "id": "GHSA-3x7p-v8hj-xh5m", "packages": ["facturascripts/facturascripts"], "path": "advisories/github-reviewed/2026/07/GHSA-3x7p-v8hj-xh5m/GHSA-3x7p-v8hj-xh5m.json", "severity": "LOW", "status": "changed", "summary": "FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`"}, {"advisory": "https://github.com/advisories/GHSA-mxwc-wh95-pw4g", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/c6718f419947064fe70016c160d434677457d6d1", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/c6718f419947064fe70016c160d434677457d6d1/advisories/github-reviewed/2026/07/GHSA-mxwc-wh95-pw4g/GHSA-mxwc-wh95-pw4g.json", "id": "GHSA-mxwc-wh95-pw4g", "packages": ["trapster"], "path": "advisories/github-reviewed/2026/07/GHSA-mxwc-wh95-pw4g/GHSA-mxwc-wh95-pw4g.json", "severity": "MODERATE", "status": "changed", "summary": "Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler"}, {"advisory": "https://github.com/advisories/GHSA-vghh-5rfx-xhq8", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/2957c4b6dbe5add45829f6ac802e9fb32a71920d", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2957c4b6dbe5add45829f6ac802e9fb32a71920d/advisories/github-reviewed/2026/11/GHSA-vghh-5rfx-xhq8/GHSA-vghh-5rfx-xhq8.json", "id": "GHSA-vghh-5rfx-xhq8", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-vghh-5rfx-xhq8/GHSA-vghh-5rfx-xhq8.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image"}, {"advisory": "https://github.com/advisories/GHSA-9fpx-fr6j-2vh6", "aliases": ["CVE-2026-33050"], "commit": "https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-9fpx-fr6j-2vh6/GHSA-9fpx-fr6j-2vh6.json", "id": "GHSA-9fpx-fr6j-2vh6", "packages": ["GeoNode"], "path": "advisories/github-reviewed/2026/11/GHSA-9fpx-fr6j-2vh6/GHSA-9fpx-fr6j-2vh6.json", "severity": "HIGH", "status": "published", "summary": "GeoNode has OS command injection via uploaded file layer name"}, {"advisory": "https://github.com/advisories/GHSA-fmc8-p6q7-75cc", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-fmc8-p6q7-75cc/GHSA-fmc8-p6q7-75cc.json", "id": "GHSA-fmc8-p6q7-75cc", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-fmc8-p6q7-75cc/GHSA-fmc8-p6q7-75cc.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has argument injection in backup compression algorithm leading to AFW and ACE"}, {"advisory": "https://github.com/advisories/GHSA-j93m-3j9p-m5m8", "aliases": ["CVE-2026-9639"], "commit": "https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-j93m-3j9p-m5m8/GHSA-j93m-3j9p-m5m8.json", "id": "GHSA-j93m-3j9p-m5m8", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-j93m-3j9p-m5m8/GHSA-j93m-3j9p-m5m8.json", "severity": "MODERATE", "status": "published", "summary": "LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at"}, {"advisory": "https://github.com/advisories/GHSA-pjff-c2wc-f6jm", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-pjff-c2wc-f6jm/GHSA-pjff-c2wc-f6jm.json", "id": "GHSA-pjff-c2wc-f6jm", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-pjff-c2wc-f6jm/GHSA-pjff-c2wc-f6jm.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has arbitrary file write on client due to trusted image hash"}, {"advisory": "https://github.com/advisories/GHSA-fqpv-mq26-pr4j", "aliases": ["CVE-2026-46429"], "commit": "https://github.com/github/advisory-database/commit/53f590f0eb6b365dd5bf54f8a077b1e0352e8252", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/53f590f0eb6b365dd5bf54f8a077b1e0352e8252/advisories/github-reviewed/2026/11/GHSA-fqpv-mq26-pr4j/GHSA-fqpv-mq26-pr4j.json", "id": "GHSA-fqpv-mq26-pr4j", "packages": ["GeoNode"], "path": "advisories/github-reviewed/2026/11/GHSA-fqpv-mq26-pr4j/GHSA-fqpv-mq26-pr4j.json", "severity": "MODERATE", "status": "published", "summary": "GeoNode has Unrestricted File Upload"}, {"advisory": "https://github.com/advisories/GHSA-r4hm-p9f9-fj9v", "aliases": ["CVE-2026-55649"], "commit": "https://github.com/github/advisory-database/commit/0d413bb2a07b6216969b5a0ab87b2b6bc37eee83", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/0d413bb2a07b6216969b5a0ab87b2b6bc37eee83/advisories/github-reviewed/2026/11/GHSA-r4hm-p9f9-fj9v/GHSA-r4hm-p9f9-fj9v.json", "id": "GHSA-r4hm-p9f9-fj9v", "packages": ["GeoNode"], "path": "advisories/github-reviewed/2026/11/GHSA-r4hm-p9f9-fj9v/GHSA-r4hm-p9f9-fj9v.json", "severity": "MODERATE", "status": "published", "summary": "GeoNode has Stored XSS in Documents metadata abstract field"}, {"advisory": "https://github.com/advisories/GHSA-47w9-6r3f-938g", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-47w9-6r3f-938g/GHSA-47w9-6r3f-938g.json", "id": "GHSA-47w9-6r3f-938g", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-47w9-6r3f-938g/GHSA-47w9-6r3f-938g.json", "severity": "CRITICAL", "status": "published", "summary": "LXD has restricted project bypass leading to arbitrary command execution"}, {"advisory": "https://github.com/advisories/GHSA-7mr3-28h5-m5vx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-7mr3-28h5-m5vx/GHSA-7mr3-28h5-m5vx.json", "id": "GHSA-7mr3-28h5-m5vx", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-7mr3-28h5-m5vx/GHSA-7mr3-28h5-m5vx.json", "severity": "HIGH", "status": "published", "summary": "LXD has project restriction bypass for custom volume copy across projects "}, {"advisory": "https://github.com/advisories/GHSA-qx75-2p3r-pwm5", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-qx75-2p3r-pwm5/GHSA-qx75-2p3r-pwm5.json", "id": "GHSA-qx75-2p3r-pwm5", "packages": ["github.com/canonical/lxd"], "path": "advisories/github-reviewed/2026/11/GHSA-qx75-2p3r-pwm5/GHSA-qx75-2p3r-pwm5.json", "severity": "HIGH", "status": "published", "summary": "LXD has project restriction bypass in instance copy across projects "}], "sourceId": "advisories-reviewed", "text": "On November 6, 2026, GitHub's security advisory list published 18 new advisories, changed 6, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1}, "project": {"projectId": 20, "name": "Security advisories (GitHub reviewed)", "kind": "watch", "keeper": "GitHub", "jurisdiction": "", "markText": "GH", "shape": "", "what": "GitHub's security advisory list", "repoUrl": "https://github.com/github/advisory-database", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "chunk": "day"}, "date": "2026-11-07", "author": {"name": "Flare Reef watcher", "handle": "", "verified": false}}