{"note": {"noteId": 452, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0xbeb9db356d3caac4aa6c15a2d0a8ae500f6fda2dc264db08e18ff95feaa80b7c", "content": "{\"counts\":{\"changed\":23,\"published\":45,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-09\",\"fullList\":{\"bytes\":47895,\"fingerprint\":\"bcf53050c596fae2cafe33522c1642f2a6fdc220ec6cdcf41d282a61e3afd0ef\",\"url\":\"https://flarereef.flareforward.com/files/watch/bcf53050c596fae2cafe33522c1642f2a6fdc220ec6cdcf41d282a61e3afd0ef.json\"},\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-10T01:25:52Z\",\"rows\":[{\"advisory\":\"https://github.com/advisories/GHSA-rfx3-98h7-v3xp\",\"aliases\":[\"CVE-2026-75513\"],\"commit\":\"https://github.com/github/advisory-database/commit/fec901422fe97937357912b981bd684ceb90ed90\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/fec901422fe97937357912b981bd684ceb90ed90/advisories/github-reviewed/2026/09/GHSA-rfx3-98h7-v3xp/GHSA-rfx3-98h7-v3xp.json\",\"id\":\"GHSA-rfx3-98h7-v3xp\",\"packages\":[\"Marten\"],\"path\":\"advisories/github-reviewed/2026/09/GHSA-rfx3-98h7-v3xp/GHSA-rfx3-98h7-v3xp.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Marten's LINQ provider has SQL injection via unescaped string literals\"},{\"advisory\":\"https://github.com/advisories/GHSA-8fxw-fmj8-xp7j\",\"aliases\":[\"CVE-2026-88023\"],\"commit\":\"https://github.com/github/advisory-database/commit/ee60ae9a10bde8d40f03690f90e8e05ae96b4cc7\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/ee60ae9a10bde8d40f03690f90e8e05ae96b4cc7/advisories/github-reviewed/2026/10/GHSA-8fxw-fmj8-xp7j/GHSA-8fxw-fmj8-xp7j.json\",\"id\":\"GHSA-8fxw-fmj8-xp7j\",\"packages\":[\"mongodb/mongodb\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-8fxw-fmj8-xp7j/GHSA-8fxw-fmj8-xp7j.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs\"},{\"advisory\":\"https://github.com/advisories/GHSA-w7qv-268h-9h3f\",\"aliases\":[\"CVE-2026-63417\"],\"commit\":\"https://github.com/github/advisory-database/commit/187275eb1a5f35244190c0102764fde701eca3e9\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/187275eb1a5f35244190c0102764fde701eca3e9/advisories/github-reviewed/2026/11/GHSA-w7qv-268h-9h3f/GHSA-w7qv-268h-9h3f.json\",\"id\":\"GHSA-w7qv-268h-9h3f\",\"packages\":[\"loggingredactor\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-w7qv-268h-9h3f/GHSA-w7qv-268h-9h3f.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Logging Redactor: PII data in str/repr of non primitive objects was not being redacted\"},{\"advisory\":\"https://github.com/advisories/GHSA-52c6-99qm-3hqr\",\"aliases\":[\"CVE-2026-63436\"],\"commit\":\"https://github.com/github/advisory-database/commit/a7fb05fbd5da52032db351e072f8da48488ad30c\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/a7fb05fbd5da52032db351e072f8da48488ad30c/advisories/github-reviewed/2026/11/GHSA-52c6-99qm-3hqr/GHSA-52c6-99qm-3hqr.json\",\"id\":\"GHSA-52c6-99qm-3hqr\",\"packages\":[\"org.zeroturnaround:zt-zip\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-52c6-99qm-3hqr/GHSA-52c6-99qm-3hqr.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"zt-zip: Path traversal in fluent API unpack\"},{\"advisory\":\"https://github.com/advisories/GHSA-h667-4jj2-cgv4\",\"aliases\":[\"CVE-2026-63470\"],\"commit\":\"https://github.com/github/advisory-database/commit/bc1817f9e59d4d1c85b11fc97dd5c357de13aaa7\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/bc1817f9e59d4d1c85b11fc97dd5c357de13aaa7/advisories/github-reviewed/2026/11/GHSA-h667-4jj2-cgv4/GHSA-h667-4jj2-cgv4.json\",\"id\":\"GHSA-h667-4jj2-cgv4\",\"packages\":[\"fastapi-code-generator\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-h667-4jj2-cgv4/GHSA-h667-4jj2-cgv4.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring\"},{\"advisory\":\"https://github.com/advisories/GHSA-6xmv-cjr5-w3q8\",\"aliases\":[\"CVE-2026-63469\"],\"commit\":\"https://github.com/github/advisory-database/commit/d67dc8470512c823300addf219feafd74338ed5b\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/d67dc8470512c823300addf219feafd74338ed5b/advisories/github-reviewed/2026/11/GHSA-6xmv-cjr5-w3q8/GHSA-6xmv-cjr5-w3q8.json\",\"id\":\"GHSA-6xmv-cjr5-w3q8\",\"packages\":[\"fastapi-code-generator\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-6xmv-cjr5-w3q8/GHSA-6xmv-cjr5-w3q8.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict\"},{\"advisory\":\"https://github.com/advisories/GHSA-p2mm-64f6-gmpp\",\"aliases\":[\"CVE-2026-63471\"],\"commit\":\"https://github.com/github/advisory-database/commit/d8fce65f49add7b6da1940cb7274d618be330da0\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/d8fce65f49add7b6da1940cb7274d618be330da0/advisories/github-reviewed/2026/11/GHSA-p2mm-64f6-gmpp/GHSA-p2mm-64f6-gmpp.json\",\"id\":\"GHSA-p2mm-64f6-gmpp\",\"packages\":[\"fastapi-code-generator\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-p2mm-64f6-gmpp/GHSA-p2mm-64f6-gmpp.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator\"},{\"advisory\":\"https://github.com/advisories/GHSA-9qw7-j9xw-fv9c\",\"aliases\":[\"CVE-2026-63395\"],\"commit\":\"https://github.com/github/advisory-database/commit/b18aaf9b65e2f55252957c08dfe5bba2bda70557\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b18aaf9b65e2f55252957c08dfe5bba2bda70557/advisories/github-reviewed/2026/11/GHSA-9qw7-j9xw-fv9c/GHSA-9qw7-j9xw-fv9c.json\",\"id\":\"GHSA-9qw7-j9xw-fv9c\",\"packages\":[\"isomorphic-git\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-9qw7-j9xw-fv9c/GHSA-9qw7-j9xw-fv9c.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE)\"},{\"advisory\":\"https://github.com/advisories/GHSA-jwjp-4649-v8jp\",\"aliases\":[\"CVE-2026-123805\"],\"commit\":\"https://github.com/github/advisory-database/commit/1c4bca1757976e10298e422db396e1982531ebdf\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/1c4bca1757976e10298e422db396e1982531ebdf/advisories/github-reviewed/2026/08/GHSA-jwjp-4649-v8jp/GHSA-jwjp-4649-v8jp.json\",\"id\":\"GHSA-jwjp-4649-v8jp\",\"packages\":[\"SIPSorcery\"],\"path\":\"advisories/github-reviewed/2026/08/GHSA-jwjp-4649-v8jp/GHSA-jwjp-4649-v8jp.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing\"},{\"advisory\":\"https://github.com/advisories/GHSA-96wc-2m84-2cj7\",\"aliases\":[\"CVE-2026-63475\"],\"commit\":\"https://github.com/github/advisory-database/commit/4638fd6c99a1a8129739415b40661d33cd1f762b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/4638fd6c99a1a8129739415b40661d33cd1f762b/advisories/github-reviewed/2026/11/GHSA-96wc-2m84-2cj7/GHSA-96wc-2m84-2cj7.json\",\"id\":\"GHSA-96wc-2m84-2cj7\",\"packages\":[\"isomorphic-git\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-96wc-2m84-2cj7/GHSA-96wc-2m84-2cj7.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)\"},{\"advisory\":\"https://github.com/advisories/GHSA-cw2g-2vwq-88w6\",\"aliases\":[\"CVE-2026-63478\"],\"commit\":\"https://github.com/github/advisory-database/commit/0f109e5ef0d3bf352aa03e494d13edd84920ecc7\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/0f109e5ef0d3bf352aa03e494d13edd84920ecc7/advisories/github-reviewed/2026/11/GHSA-cw2g-2vwq-88w6/GHSA-cw2g-2vwq-88w6.json\",\"id\":\"GHSA-cw2g-2vwq-88w6\",\"packages\":[\"isomorphic-git\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-cw2g-2vwq-88w6/GHSA-cw2g-2vwq-88w6.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"isomorphic-git: Path traversal via a \\\"..\\\" tree-entry name writes files outside the working directory on clone/checkout\"},{\"advisory\":\"https://github.com/advisories/GHSA-qp9x-wp8f-qgjj\",\"aliases\":[\"CVE-2026-123806\"],\"commit\":\"https://github.com/github/advisory-database/commit/f10b20320c074faa1adba992e7cc44b62eb6f12b\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/f10b20320c074faa1adba992e7cc44b62eb6f12b/advisories/github-reviewed/2026/05/GHSA-qp9x-wp8f-qgjj/GHSA-qp9x-wp8f-qgjj.json\",\"id\":\"GHSA-qp9x-wp8f-qgjj\",\"packages\":[\"tuf\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-qp9x-wp8f-qgjj/GHSA-qp9x-wp8f-qgjj.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"tuf has platform-dependent delegation path matching\"},{\"advisory\":\"https://github.com/advisories/GHSA-4xm8-rg9h-jhq2\",\"aliases\":[\"CVE-2026-123807\"],\"commit\":\"https://github.com/github/advisory-database/commit/cfd604cb0ab6b56e205fad72b7f7d5b04583869f\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/cfd604cb0ab6b56e205fad72b7f7d5b04583869f/advisories/github-reviewed/2026/10/GHSA-4xm8-rg9h-jhq2/GHSA-4xm8-rg9h-jhq2.json\",\"id\":\"GHSA-4xm8-rg9h-jhq2\",\"packages\":[\"signalk-server\",\"@signalk/resources-provider\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-4xm8-rg9h-jhq2/GHSA-4xm8-rg9h-jhq2.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution\"},{\"advisory\":\"https://github.com/advisories/GHSA-p74g-f95m-7fx7\",\"aliases\":[\"CVE-2026-63197\"],\"commit\":\"https://github.com/github/advisory-database/commit/03ce40e4060df762d53ee2f994002a8c0f096e17\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/03ce40e4060df762d53ee2f994002a8c0f096e17/advisories/github-reviewed/2026/11/GHSA-p74g-f95m-7fx7/GHSA-p74g-f95m-7fx7.json\",\"id\":\"GHSA-p74g-f95m-7fx7\",\"packages\":[\"github.com/traPtitech/traQ\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-p74g-f95m-7fx7/GHSA-p74g-f95m-7fx7.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"traQ: XSS in the User Uploaded File Retrieval API\"},{\"advisory\":\"https://github.com/advisories/GHSA-xrmj-5g4g-8987\",\"aliases\":[\"CVE-2026-123809\"],\"commit\":\"https://github.com/github/advisory-database/commit/517b1dfd255d57ee85dda6bde92abdad0ba31dc1\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/517b1dfd255d57ee85dda6bde92abdad0ba31dc1/advisories/github-reviewed/2026/07/GHSA-xrmj-5g4g-8987/GHSA-xrmj-5g4g-8987.json\",\"id\":\"GHSA-xrmj-5g4g-8987\",\"packages\":[\"@dynatrace-oss/dynatrace-mcp-server\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-xrmj-5g4g-8987/GHSA-xrmj-5g4g-8987.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification\"},{\"advisory\":\"https://github.com/advisories/GHSA-8cfq-jgf7-8m27\",\"aliases\":[\"CVE-2026-63198\"],\"commit\":\"https://github.com/github/advisory-database/commit/517b1dfd255d57ee85dda6bde92abdad0ba31dc1\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/517b1dfd255d57ee85dda6bde92abdad0ba31dc1/advisories/github-reviewed/2026/11/GHSA-8cfq-jgf7-8m27/GHSA-8cfq-jgf7-8m27.json\",\"id\":\"GHSA-8cfq-jgf7-8m27\",\"packages\":[\"github.com/traPtitech/traQ\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-8cfq-jgf7-8m27/GHSA-8cfq-jgf7-8m27.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"traQ: Privilege escalation by OAuth prompt=none request\"},{\"advisory\":\"https://github.com/advisories/GHSA-pqh8-p93p-2rx7\",\"aliases\":[\"CVE-2026-123810\"],\"commit\":\"https://github.com/github/advisory-database/commit/5520d19b6b821e6c9bf2bd2315ee532fab225fe3\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/5520d19b6b821e6c9bf2bd2315ee532fab225fe3/advisories/github-reviewed/2026/07/GHSA-pqh8-p93p-2rx7/GHSA-pqh8-p93p-2rx7.json\",\"id\":\"GHSA-pqh8-p93p-2rx7\",\"packages\":[\"@dynatrace-oss/dynatrace-mcp-server\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-pqh8-p93p-2rx7/GHSA-pqh8-p93p-2rx7.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL\"},{\"advisory\":\"https://github.com/advisories/GHSA-p7w7-4929-vpj5\",\"aliases\":[\"CVE-2026-123811\"],\"commit\":\"https://github.com/github/advisory-database/commit/b6f283b1b6f012d834ca100a3464fc0ec6cd71e8\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b6f283b1b6f012d834ca100a3464fc0ec6cd71e8/advisories/github-reviewed/2026/07/GHSA-p7w7-4929-vpj5/GHSA-p7w7-4929-vpj5.json\",\"id\":\"GHSA-p7w7-4929-vpj5\",\"packages\":[\"@dynatrace-oss/dynatrace-mcp-server\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-p7w7-4929-vpj5/GHSA-p7w7-4929-vpj5.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation\"},{\"advisory\":\"https://github.com/advisories/GHSA-v2g6-7r9j-v6px\",\"aliases\":[\"CVE-2026-63499\"],\"commit\":\"https://github.com/github/advisory-database/commit/3d4058fecd81d20aaf6b63564c77bd766c6ce556\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/3d4058fecd81d20aaf6b63564c77bd766c6ce556/advisories/github-reviewed/2026/11/GHSA-v2g6-7r9j-v6px/GHSA-v2g6-7r9j-v6px.json\",\"id\":\"GHSA-v2g6-7r9j-v6px\",\"packages\":[\"org.zeroturnaround:zt-zip\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-v2g6-7r9j-v6px/GHSA-v2g6-7r9j-v6px.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"zt-zip: ZipUtil.unpack can change file permissions of output directory\"},{\"advisory\":\"https://github.com/advisories/GHSA-jq7h-wrvp-3rgx\",\"aliases\":[\"CVE-2026-123813\"],\"commit\":\"https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/10/GHSA-jq7h-wrvp-3rgx/GHSA-jq7h-wrvp-3rgx.json\",\"id\":\"GHSA-jq7h-wrvp-3rgx\",\"packages\":[\"pyload-ng\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-jq7h-wrvp-3rgx/GHSA-jq7h-wrvp-3rgx.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session\"},{\"advisory\":\"https://github.com/advisories/GHSA-p3pr-8f3m-4qp8\",\"aliases\":[\"CVE-2026-123814\"],\"commit\":\"https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/10/GHSA-p3pr-8f3m-4qp8/GHSA-p3pr-8f3m-4qp8.json\",\"id\":\"GHSA-p3pr-8f3m-4qp8\",\"packages\":[\"pyload-ng\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-p3pr-8f3m-4qp8/GHSA-p3pr-8f3m-4qp8.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host\"},{\"advisory\":\"https://github.com/advisories/GHSA-6w3r-6hpr-hp6p\",\"aliases\":[\"CVE-2026-63501\"],\"commit\":\"https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/11/GHSA-6w3r-6hpr-hp6p/GHSA-6w3r-6hpr-hp6p.json\",\"id\":\"GHSA-6w3r-6hpr-hp6p\",\"packages\":[\"ag-psd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-6w3r-6hpr-hp6p/GHSA-6w3r-6hpr-hp6p.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)\"},{\"advisory\":\"https://github.com/advisories/GHSA-fr26-jjhm-638c\",\"aliases\":[\"CVE-2026-123815\"],\"commit\":\"https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/10/GHSA-fr26-jjhm-638c/GHSA-fr26-jjhm-638c.json\",\"id\":\"GHSA-fr26-jjhm-638c\",\"packages\":[\"pyload-ng\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-fr26-jjhm-638c/GHSA-fr26-jjhm-638c.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)\"},{\"advisory\":\"https://github.com/advisories/GHSA-447x-qqwf-m7xq\",\"aliases\":[\"CVE-2026-63655\"],\"commit\":\"https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/11/GHSA-447x-qqwf-m7xq/GHSA-447x-qqwf-m7xq.json\",\"id\":\"GHSA-447x-qqwf-m7xq\",\"packages\":[\"@tsparticles/mcp-server\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-447x-qqwf-m7xq/GHSA-447x-qqwf-m7xq.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS\"},{\"advisory\":\"https://github.com/advisories/GHSA-ghc9-756g-vrcv\",\"aliases\":[\"CVE-2026-59171\"],\"commit\":\"https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/11/GHSA-ghc9-756g-vrcv/GHSA-ghc9-756g-vrcv.json\",\"id\":\"GHSA-ghc9-756g-vrcv\",\"packages\":[\"org.json:json\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-ghc9-756g-vrcv/GHSA-ghc9-756g-vrcv.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS\"},{\"advisory\":\"https://github.com/advisories/GHSA-r44w-v6gf-x3p6\",\"aliases\":[\"CVE-2026-123816\"],\"commit\":\"https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/10/GHSA-r44w-v6gf-x3p6/GHSA-r44w-v6gf-x3p6.json\",\"id\":\"GHSA-r44w-v6gf-x3p6\",\"packages\":[\"pyload-ng\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-r44w-v6gf-x3p6/GHSA-r44w-v6gf-x3p6.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"pyLoad has an authentication bypass in API key validation (check_apikey cache)\"},{\"advisory\":\"https://github.com/advisories/GHSA-4p8p-pjpq-2w7h\",\"aliases\":[\"CVE-2026-76892\"],\"commit\":\"https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/11/GHSA-4p8p-pjpq-2w7h/GHSA-4p8p-pjpq-2w7h.json\",\"id\":\"GHSA-4p8p-pjpq-2w7h\",\"packages\":[\"@tsparticles/mcp-server\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-4p8p-pjpq-2w7h/GHSA-4p8p-pjpq-2w7h.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process\"},{\"advisory\":\"https://github.com/advisories/GHSA-h7c4-q426-7jh9\",\"aliases\":[\"CVE-2026-76893\"],\"commit\":\"https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/11/GHSA-h7c4-q426-7jh9/GHSA-h7c4-q426-7jh9.json\",\"id\":\"GHSA-h7c4-q426-7jh9\",\"packages\":[\"@tsparticles/mcp-server\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-h7c4-q426-7jh9/GHSA-h7c4-q426-7jh9.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients\"},{\"advisory\":\"https://github.com/advisories/GHSA-39wr-7q6h-cf68\",\"aliases\":[\"CVE-2026-123818\"],\"commit\":\"https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/09/GHSA-39wr-7q6h-cf68/GHSA-39wr-7q6h-cf68.json\",\"id\":\"GHSA-39wr-7q6h-cf68\",\"packages\":[\"lmdeploy\"],\"path\":\"advisories/github-reviewed/2026/09/GHSA-39wr-7q6h-cf68/GHSA-39wr-7q6h-cf68.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"LMDeploy has an SSRF bypass\"},{\"advisory\":\"https://github.com/advisories/GHSA-2g87-pp6c-29x5\",\"aliases\":[\"CVE-2026-123817\"],\"commit\":\"https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/10/GHSA-2g87-pp6c-29x5/GHSA-2g87-pp6c-29x5.json\",\"id\":\"GHSA-2g87-pp6c-29x5\",\"packages\":[\"aiohttp\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-2g87-pp6c-29x5/GHSA-2g87-pp6c-29x5.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"aiohttp: Multiple instances of excessive or unbounded memory/CPU use\"},{\"advisory\":\"https://github.com/advisories/GHSA-56x6-q882-mf27\",\"aliases\":[\"CVE-2026-77463\"],\"commit\":\"https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/11/GHSA-56x6-q882-mf27/GHSA-56x6-q882-mf27.json\",\"id\":\"GHSA-56x6-q882-mf27\",\"packages\":[\"github.com/umputun/remark42/backend\",\"github.com/umputun/remark42\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-56x6-q882-mf27/GHSA-56x6-q882-mf27.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment\"},{\"advisory\":\"https://github.com/advisories/GHSA-q4xm-p75h-h9p3\",\"aliases\":[\"CVE-2026-62662\"],\"commit\":\"https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/11/GHSA-q4xm-p75h-h9p3/GHSA-q4xm-p75h-h9p3.json\",\"id\":\"GHSA-q4xm-p75h-h9p3\",\"packages\":[\"github.com/pocket-id/pocket-id/backend\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-q4xm-p75h-h9p3/GHSA-q4xm-p75h-h9p3.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences\"},{\"advisory\":\"https://github.com/advisories/GHSA-92hv-j533-69wc\",\"aliases\":[\"CVE-2026-125105\"],\"commit\":\"https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-92hv-j533-69wc/GHSA-92hv-j533-69wc.json\",\"id\":\"GHSA-92hv-j533-69wc\",\"packages\":[\"wagtail\"],\"path\":\"advisories/github-reviewed/2026/08/GHSA-92hv-j533-69wc/GHSA-92hv-j533-69wc.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"Wagtail: Identification of documents by SHA1 hash\"},{\"advisory\":\"https://github.com/advisories/GHSA-jm5p-837g-rv8g\",\"aliases\":[\"CVE-2026-125106\"],\"commit\":\"https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-jm5p-837g-rv8g/GHSA-jm5p-837g-rv8g.json\",\"id\":\"GHSA-jm5p-837g-rv8g\",\"packages\":[\"wagtail\"],\"path\":\"advisories/github-reviewed/2026/08/GHSA-jm5p-837g-rv8g/GHSA-jm5p-837g-rv8g.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Wagtail: Improper restriction handling on Page translation API endpoint\"},{\"advisory\":\"https://github.com/advisories/GHSA-x5cx-w6p2-mxf2\",\"aliases\":[\"CVE-2026-123819\"],\"commit\":\"https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-x5cx-w6p2-mxf2/GHSA-x5cx-w6p2-mxf2.json\",\"id\":\"GHSA-x5cx-w6p2-mxf2\",\"packages\":[\"wagtail\"],\"path\":\"advisories/github-reviewed/2026/08/GHSA-x5cx-w6p2-mxf2/GHSA-x5cx-w6p2-mxf2.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Wagtail: Improper permission handling when copying snippets\"},{\"advisory\":\"https://github.com/advisories/GHSA-vvr2-h2jp-838m\",\"aliases\":[\"CVE-2026-77604\"],\"commit\":\"https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/11/GHSA-vvr2-h2jp-838m/GHSA-vvr2-h2jp-838m.json\",\"id\":\"GHSA-vvr2-h2jp-838m\",\"packages\":[\"code-graph-rag\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-vvr2-h2jp-838m/GHSA-vvr2-h2jp-838m.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read\"},{\"advisory\":\"https://github.com/advisories/GHSA-fhp4-pr5j-46m5\",\"aliases\":[\"CVE-2026-125107\"],\"commit\":\"https://github.com/github/advisory-database/commit/81569964abbda58f1f1d15a2dcbd97e7b0834cb6\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/81569964abbda58f1f1d15a2dcbd97e7b0834cb6/advisories/github-reviewed/2026/06/GHSA-fhp4-pr5j-46m5/GHSA-fhp4-pr5j-46m5.json\",\"id\":\"GHSA-fhp4-pr5j-46m5\",\"packages\":[\"muhammara\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-fhp4-pr5j-46m5/GHSA-fhp4-pr5j-46m5.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key\"},{\"advisory\":\"https://github.com/advisories/GHSA-rrh3-cwwj-g5mg\",\"aliases\":[\"CVE-2026-43637\"],\"commit\":\"https://github.com/github/advisory-database/commit/f953a301e2218bac05e58fd9b70f8a2f3b903eb8\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/f953a301e2218bac05e58fd9b70f8a2f3b903eb8/advisories/github-reviewed/2026/07/GHSA-rrh3-cwwj-g5mg/GHSA-rrh3-cwwj-g5mg.json\",\"id\":\"GHSA-rrh3-cwwj-g5mg\",\"packages\":[\"cornac\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-rrh3-cwwj-g5mg/GHSA-rrh3-cwwj-g5mg.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Cornac: Path Traversal via _extract_archive() in download.py\"},{\"advisory\":\"https://github.com/advisories/GHSA-m27g-v28p-f9fx\",\"aliases\":[\"CVE-2026-63183\"],\"commit\":\"https://github.com/github/advisory-database/commit/c8192f690a9aae85b462b4fde4315042d4e03a32\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/c8192f690a9aae85b462b4fde4315042d4e03a32/advisories/github-reviewed/2026/11/GHSA-m27g-v28p-f9fx/GHSA-m27g-v28p-f9fx.json\",\"id\":\"GHSA-m27g-v28p-f9fx\",\"packages\":[\"omniauth\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-m27g-v28p-f9fx/GHSA-m27g-v28p-f9fx.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"OmniAuth: Host Header Injection Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-rr8v-fxxf-c986\",\"aliases\":[\"CVE-2026-75598\"],\"commit\":\"https://github.com/github/advisory-database/commit/c8192f690a9aae85b462b4fde4315042d4e03a32\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/c8192f690a9aae85b462b4fde4315042d4e03a32/advisories/github-reviewed/2026/11/GHSA-rr8v-fxxf-c986/GHSA-rr8v-fxxf-c986.json\",\"id\":\"GHSA-rr8v-fxxf-c986\",\"packages\":[\"com.gradleup.shadow:com.gradleup.shadow.gradle.plugin\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-rr8v-fxxf-c986/GHSA-rr8v-fxxf-c986.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Gradle Shadow: Zip Slip path traversal in ShadowCopyAction \u2014 no independent entry-name sanitization\"}],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 9, 2026, GitHub's security advisory list published 45 new advisories, changed 23, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "https://flarereef.flareforward.com/files/watch/bcf53050c596fae2cafe33522c1642f2a6fdc220ec6cdcf41d282a61e3afd0ef.json", "txHash": "0x1faabc7b5c7b9592ef333458876f839bb1afdb23edbf8bfcf728a7d19e9d6999", "receiptUrl": "https://flare-explorer.flare.network/tx/0x1faabc7b5c7b9592ef333458876f839bb1afdb23edbf8bfcf728a7d19e9d6999", "blockNumber": 74167937, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": [], "parsed": {"counts": {"changed": 23, "published": 45, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-09", "kind": "watch-day", "recordedAt": "2026-11-10T01:25:52Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-rfx3-98h7-v3xp", "aliases": ["CVE-2026-75513"], "commit": "https://github.com/github/advisory-database/commit/fec901422fe97937357912b981bd684ceb90ed90", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/fec901422fe97937357912b981bd684ceb90ed90/advisories/github-reviewed/2026/09/GHSA-rfx3-98h7-v3xp/GHSA-rfx3-98h7-v3xp.json", "id": "GHSA-rfx3-98h7-v3xp", "packages": ["Marten"], "path": "advisories/github-reviewed/2026/09/GHSA-rfx3-98h7-v3xp/GHSA-rfx3-98h7-v3xp.json", "severity": "CRITICAL", "status": "changed", "summary": "Marten's LINQ provider has SQL injection via unescaped string literals"}, {"advisory": "https://github.com/advisories/GHSA-8fxw-fmj8-xp7j", "aliases": ["CVE-2026-88023"], "commit": "https://github.com/github/advisory-database/commit/ee60ae9a10bde8d40f03690f90e8e05ae96b4cc7", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/ee60ae9a10bde8d40f03690f90e8e05ae96b4cc7/advisories/github-reviewed/2026/10/GHSA-8fxw-fmj8-xp7j/GHSA-8fxw-fmj8-xp7j.json", "id": "GHSA-8fxw-fmj8-xp7j", "packages": ["mongodb/mongodb"], "path": "advisories/github-reviewed/2026/10/GHSA-8fxw-fmj8-xp7j/GHSA-8fxw-fmj8-xp7j.json", "severity": "MODERATE", "status": "changed", "summary": "MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs"}, {"advisory": "https://github.com/advisories/GHSA-w7qv-268h-9h3f", "aliases": ["CVE-2026-63417"], "commit": "https://github.com/github/advisory-database/commit/187275eb1a5f35244190c0102764fde701eca3e9", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/187275eb1a5f35244190c0102764fde701eca3e9/advisories/github-reviewed/2026/11/GHSA-w7qv-268h-9h3f/GHSA-w7qv-268h-9h3f.json", "id": "GHSA-w7qv-268h-9h3f", "packages": ["loggingredactor"], "path": "advisories/github-reviewed/2026/11/GHSA-w7qv-268h-9h3f/GHSA-w7qv-268h-9h3f.json", "severity": "HIGH", "status": "published", "summary": "Logging Redactor: PII data in str/repr of non primitive objects was not being redacted"}, {"advisory": "https://github.com/advisories/GHSA-52c6-99qm-3hqr", "aliases": ["CVE-2026-63436"], "commit": "https://github.com/github/advisory-database/commit/a7fb05fbd5da52032db351e072f8da48488ad30c", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/a7fb05fbd5da52032db351e072f8da48488ad30c/advisories/github-reviewed/2026/11/GHSA-52c6-99qm-3hqr/GHSA-52c6-99qm-3hqr.json", "id": "GHSA-52c6-99qm-3hqr", "packages": ["org.zeroturnaround:zt-zip"], "path": "advisories/github-reviewed/2026/11/GHSA-52c6-99qm-3hqr/GHSA-52c6-99qm-3hqr.json", "severity": "HIGH", "status": "published", "summary": "zt-zip: Path traversal in fluent API unpack"}, {"advisory": "https://github.com/advisories/GHSA-h667-4jj2-cgv4", "aliases": ["CVE-2026-63470"], "commit": "https://github.com/github/advisory-database/commit/bc1817f9e59d4d1c85b11fc97dd5c357de13aaa7", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/bc1817f9e59d4d1c85b11fc97dd5c357de13aaa7/advisories/github-reviewed/2026/11/GHSA-h667-4jj2-cgv4/GHSA-h667-4jj2-cgv4.json", "id": "GHSA-h667-4jj2-cgv4", "packages": ["fastapi-code-generator"], "path": "advisories/github-reviewed/2026/11/GHSA-h667-4jj2-cgv4/GHSA-h667-4jj2-cgv4.json", "severity": "CRITICAL", "status": "published", "summary": "fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring"}, {"advisory": "https://github.com/advisories/GHSA-6xmv-cjr5-w3q8", "aliases": ["CVE-2026-63469"], "commit": "https://github.com/github/advisory-database/commit/d67dc8470512c823300addf219feafd74338ed5b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/d67dc8470512c823300addf219feafd74338ed5b/advisories/github-reviewed/2026/11/GHSA-6xmv-cjr5-w3q8/GHSA-6xmv-cjr5-w3q8.json", "id": "GHSA-6xmv-cjr5-w3q8", "packages": ["fastapi-code-generator"], "path": "advisories/github-reviewed/2026/11/GHSA-6xmv-cjr5-w3q8/GHSA-6xmv-cjr5-w3q8.json", "severity": "CRITICAL", "status": "published", "summary": "fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict"}, {"advisory": "https://github.com/advisories/GHSA-p2mm-64f6-gmpp", "aliases": ["CVE-2026-63471"], "commit": "https://github.com/github/advisory-database/commit/d8fce65f49add7b6da1940cb7274d618be330da0", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/d8fce65f49add7b6da1940cb7274d618be330da0/advisories/github-reviewed/2026/11/GHSA-p2mm-64f6-gmpp/GHSA-p2mm-64f6-gmpp.json", "id": "GHSA-p2mm-64f6-gmpp", "packages": ["fastapi-code-generator"], "path": "advisories/github-reviewed/2026/11/GHSA-p2mm-64f6-gmpp/GHSA-p2mm-64f6-gmpp.json", "severity": "CRITICAL", "status": "published", "summary": "fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator"}, {"advisory": "https://github.com/advisories/GHSA-9qw7-j9xw-fv9c", "aliases": ["CVE-2026-63395"], "commit": "https://github.com/github/advisory-database/commit/b18aaf9b65e2f55252957c08dfe5bba2bda70557", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b18aaf9b65e2f55252957c08dfe5bba2bda70557/advisories/github-reviewed/2026/11/GHSA-9qw7-j9xw-fv9c/GHSA-9qw7-j9xw-fv9c.json", "id": "GHSA-9qw7-j9xw-fv9c", "packages": ["isomorphic-git"], "path": "advisories/github-reviewed/2026/11/GHSA-9qw7-j9xw-fv9c/GHSA-9qw7-j9xw-fv9c.json", "severity": "HIGH", "status": "published", "summary": "isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE)"}, {"advisory": "https://github.com/advisories/GHSA-jwjp-4649-v8jp", "aliases": ["CVE-2026-123805"], "commit": "https://github.com/github/advisory-database/commit/1c4bca1757976e10298e422db396e1982531ebdf", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/1c4bca1757976e10298e422db396e1982531ebdf/advisories/github-reviewed/2026/08/GHSA-jwjp-4649-v8jp/GHSA-jwjp-4649-v8jp.json", "id": "GHSA-jwjp-4649-v8jp", "packages": ["SIPSorcery"], "path": "advisories/github-reviewed/2026/08/GHSA-jwjp-4649-v8jp/GHSA-jwjp-4649-v8jp.json", "severity": "HIGH", "status": "changed", "summary": "SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing"}, {"advisory": "https://github.com/advisories/GHSA-96wc-2m84-2cj7", "aliases": ["CVE-2026-63475"], "commit": "https://github.com/github/advisory-database/commit/4638fd6c99a1a8129739415b40661d33cd1f762b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/4638fd6c99a1a8129739415b40661d33cd1f762b/advisories/github-reviewed/2026/11/GHSA-96wc-2m84-2cj7/GHSA-96wc-2m84-2cj7.json", "id": "GHSA-96wc-2m84-2cj7", "packages": ["isomorphic-git"], "path": "advisories/github-reviewed/2026/11/GHSA-96wc-2m84-2cj7/GHSA-96wc-2m84-2cj7.json", "severity": "MODERATE", "status": "published", "summary": "isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)"}, {"advisory": "https://github.com/advisories/GHSA-cw2g-2vwq-88w6", "aliases": ["CVE-2026-63478"], "commit": "https://github.com/github/advisory-database/commit/0f109e5ef0d3bf352aa03e494d13edd84920ecc7", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/0f109e5ef0d3bf352aa03e494d13edd84920ecc7/advisories/github-reviewed/2026/11/GHSA-cw2g-2vwq-88w6/GHSA-cw2g-2vwq-88w6.json", "id": "GHSA-cw2g-2vwq-88w6", "packages": ["isomorphic-git"], "path": "advisories/github-reviewed/2026/11/GHSA-cw2g-2vwq-88w6/GHSA-cw2g-2vwq-88w6.json", "severity": "MODERATE", "status": "published", "summary": "isomorphic-git: Path traversal via a \"..\" tree-entry name writes files outside the working directory on clone/checkout"}, {"advisory": "https://github.com/advisories/GHSA-qp9x-wp8f-qgjj", "aliases": ["CVE-2026-123806"], "commit": "https://github.com/github/advisory-database/commit/f10b20320c074faa1adba992e7cc44b62eb6f12b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f10b20320c074faa1adba992e7cc44b62eb6f12b/advisories/github-reviewed/2026/05/GHSA-qp9x-wp8f-qgjj/GHSA-qp9x-wp8f-qgjj.json", "id": "GHSA-qp9x-wp8f-qgjj", "packages": ["tuf"], "path": "advisories/github-reviewed/2026/05/GHSA-qp9x-wp8f-qgjj/GHSA-qp9x-wp8f-qgjj.json", "severity": "MODERATE", "status": "changed", "summary": "tuf has platform-dependent delegation path matching"}, {"advisory": "https://github.com/advisories/GHSA-4xm8-rg9h-jhq2", "aliases": ["CVE-2026-123807"], "commit": "https://github.com/github/advisory-database/commit/cfd604cb0ab6b56e205fad72b7f7d5b04583869f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/cfd604cb0ab6b56e205fad72b7f7d5b04583869f/advisories/github-reviewed/2026/10/GHSA-4xm8-rg9h-jhq2/GHSA-4xm8-rg9h-jhq2.json", "id": "GHSA-4xm8-rg9h-jhq2", "packages": ["signalk-server", "@signalk/resources-provider"], "path": "advisories/github-reviewed/2026/10/GHSA-4xm8-rg9h-jhq2/GHSA-4xm8-rg9h-jhq2.json", "severity": "CRITICAL", "status": "changed", "summary": "Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution"}, {"advisory": "https://github.com/advisories/GHSA-p74g-f95m-7fx7", "aliases": ["CVE-2026-63197"], "commit": "https://github.com/github/advisory-database/commit/03ce40e4060df762d53ee2f994002a8c0f096e17", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/03ce40e4060df762d53ee2f994002a8c0f096e17/advisories/github-reviewed/2026/11/GHSA-p74g-f95m-7fx7/GHSA-p74g-f95m-7fx7.json", "id": "GHSA-p74g-f95m-7fx7", "packages": ["github.com/traPtitech/traQ"], "path": "advisories/github-reviewed/2026/11/GHSA-p74g-f95m-7fx7/GHSA-p74g-f95m-7fx7.json", "severity": "HIGH", "status": "published", "summary": "traQ: XSS in the User Uploaded File Retrieval API"}, {"advisory": "https://github.com/advisories/GHSA-xrmj-5g4g-8987", "aliases": ["CVE-2026-123809"], "commit": "https://github.com/github/advisory-database/commit/517b1dfd255d57ee85dda6bde92abdad0ba31dc1", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/517b1dfd255d57ee85dda6bde92abdad0ba31dc1/advisories/github-reviewed/2026/07/GHSA-xrmj-5g4g-8987/GHSA-xrmj-5g4g-8987.json", "id": "GHSA-xrmj-5g4g-8987", "packages": ["@dynatrace-oss/dynatrace-mcp-server"], "path": "advisories/github-reviewed/2026/07/GHSA-xrmj-5g4g-8987/GHSA-xrmj-5g4g-8987.json", "severity": "MODERATE", "status": "changed", "summary": "@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification"}, {"advisory": "https://github.com/advisories/GHSA-8cfq-jgf7-8m27", "aliases": ["CVE-2026-63198"], "commit": "https://github.com/github/advisory-database/commit/517b1dfd255d57ee85dda6bde92abdad0ba31dc1", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/517b1dfd255d57ee85dda6bde92abdad0ba31dc1/advisories/github-reviewed/2026/11/GHSA-8cfq-jgf7-8m27/GHSA-8cfq-jgf7-8m27.json", "id": "GHSA-8cfq-jgf7-8m27", "packages": ["github.com/traPtitech/traQ"], "path": "advisories/github-reviewed/2026/11/GHSA-8cfq-jgf7-8m27/GHSA-8cfq-jgf7-8m27.json", "severity": "HIGH", "status": "published", "summary": "traQ: Privilege escalation by OAuth prompt=none request"}, {"advisory": "https://github.com/advisories/GHSA-pqh8-p93p-2rx7", "aliases": ["CVE-2026-123810"], "commit": "https://github.com/github/advisory-database/commit/5520d19b6b821e6c9bf2bd2315ee532fab225fe3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/5520d19b6b821e6c9bf2bd2315ee532fab225fe3/advisories/github-reviewed/2026/07/GHSA-pqh8-p93p-2rx7/GHSA-pqh8-p93p-2rx7.json", "id": "GHSA-pqh8-p93p-2rx7", "packages": ["@dynatrace-oss/dynatrace-mcp-server"], "path": "advisories/github-reviewed/2026/07/GHSA-pqh8-p93p-2rx7/GHSA-pqh8-p93p-2rx7.json", "severity": "MODERATE", "status": "changed", "summary": "@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL"}, {"advisory": "https://github.com/advisories/GHSA-p7w7-4929-vpj5", "aliases": ["CVE-2026-123811"], "commit": "https://github.com/github/advisory-database/commit/b6f283b1b6f012d834ca100a3464fc0ec6cd71e8", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b6f283b1b6f012d834ca100a3464fc0ec6cd71e8/advisories/github-reviewed/2026/07/GHSA-p7w7-4929-vpj5/GHSA-p7w7-4929-vpj5.json", "id": "GHSA-p7w7-4929-vpj5", "packages": ["@dynatrace-oss/dynatrace-mcp-server"], "path": "advisories/github-reviewed/2026/07/GHSA-p7w7-4929-vpj5/GHSA-p7w7-4929-vpj5.json", "severity": "HIGH", "status": "changed", "summary": "`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation"}, {"advisory": "https://github.com/advisories/GHSA-v2g6-7r9j-v6px", "aliases": ["CVE-2026-63499"], "commit": "https://github.com/github/advisory-database/commit/3d4058fecd81d20aaf6b63564c77bd766c6ce556", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/3d4058fecd81d20aaf6b63564c77bd766c6ce556/advisories/github-reviewed/2026/11/GHSA-v2g6-7r9j-v6px/GHSA-v2g6-7r9j-v6px.json", "id": "GHSA-v2g6-7r9j-v6px", "packages": ["org.zeroturnaround:zt-zip"], "path": "advisories/github-reviewed/2026/11/GHSA-v2g6-7r9j-v6px/GHSA-v2g6-7r9j-v6px.json", "severity": "MODERATE", "status": "published", "summary": "zt-zip: ZipUtil.unpack can change file permissions of output directory"}, {"advisory": "https://github.com/advisories/GHSA-jq7h-wrvp-3rgx", "aliases": ["CVE-2026-123813"], "commit": "https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/10/GHSA-jq7h-wrvp-3rgx/GHSA-jq7h-wrvp-3rgx.json", "id": "GHSA-jq7h-wrvp-3rgx", "packages": ["pyload-ng"], "path": "advisories/github-reviewed/2026/10/GHSA-jq7h-wrvp-3rgx/GHSA-jq7h-wrvp-3rgx.json", "severity": "HIGH", "status": "changed", "summary": "pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session"}, {"advisory": "https://github.com/advisories/GHSA-p3pr-8f3m-4qp8", "aliases": ["CVE-2026-123814"], "commit": "https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/10/GHSA-p3pr-8f3m-4qp8/GHSA-p3pr-8f3m-4qp8.json", "id": "GHSA-p3pr-8f3m-4qp8", "packages": ["pyload-ng"], "path": "advisories/github-reviewed/2026/10/GHSA-p3pr-8f3m-4qp8/GHSA-p3pr-8f3m-4qp8.json", "severity": "MODERATE", "status": "changed", "summary": "pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host"}, {"advisory": "https://github.com/advisories/GHSA-6w3r-6hpr-hp6p", "aliases": ["CVE-2026-63501"], "commit": "https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/11/GHSA-6w3r-6hpr-hp6p/GHSA-6w3r-6hpr-hp6p.json", "id": "GHSA-6w3r-6hpr-hp6p", "packages": ["ag-psd"], "path": "advisories/github-reviewed/2026/11/GHSA-6w3r-6hpr-hp6p/GHSA-6w3r-6hpr-hp6p.json", "severity": "HIGH", "status": "published", "summary": "ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)"}, {"advisory": "https://github.com/advisories/GHSA-fr26-jjhm-638c", "aliases": ["CVE-2026-123815"], "commit": "https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/10/GHSA-fr26-jjhm-638c/GHSA-fr26-jjhm-638c.json", "id": "GHSA-fr26-jjhm-638c", "packages": ["pyload-ng"], "path": "advisories/github-reviewed/2026/10/GHSA-fr26-jjhm-638c/GHSA-fr26-jjhm-638c.json", "severity": "HIGH", "status": "changed", "summary": "pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)"}, {"advisory": "https://github.com/advisories/GHSA-447x-qqwf-m7xq", "aliases": ["CVE-2026-63655"], "commit": "https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/11/GHSA-447x-qqwf-m7xq/GHSA-447x-qqwf-m7xq.json", "id": "GHSA-447x-qqwf-m7xq", "packages": ["@tsparticles/mcp-server"], "path": "advisories/github-reviewed/2026/11/GHSA-447x-qqwf-m7xq/GHSA-447x-qqwf-m7xq.json", "severity": "HIGH", "status": "published", "summary": "tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS"}, {"advisory": "https://github.com/advisories/GHSA-ghc9-756g-vrcv", "aliases": ["CVE-2026-59171"], "commit": "https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/11/GHSA-ghc9-756g-vrcv/GHSA-ghc9-756g-vrcv.json", "id": "GHSA-ghc9-756g-vrcv", "packages": ["org.json:json"], "path": "advisories/github-reviewed/2026/11/GHSA-ghc9-756g-vrcv/GHSA-ghc9-756g-vrcv.json", "severity": "MODERATE", "status": "published", "summary": "JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS"}, {"advisory": "https://github.com/advisories/GHSA-r44w-v6gf-x3p6", "aliases": ["CVE-2026-123816"], "commit": "https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/10/GHSA-r44w-v6gf-x3p6/GHSA-r44w-v6gf-x3p6.json", "id": "GHSA-r44w-v6gf-x3p6", "packages": ["pyload-ng"], "path": "advisories/github-reviewed/2026/10/GHSA-r44w-v6gf-x3p6/GHSA-r44w-v6gf-x3p6.json", "severity": "HIGH", "status": "changed", "summary": "pyLoad has an authentication bypass in API key validation (check_apikey cache)"}, {"advisory": "https://github.com/advisories/GHSA-4p8p-pjpq-2w7h", "aliases": ["CVE-2026-76892"], "commit": "https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/11/GHSA-4p8p-pjpq-2w7h/GHSA-4p8p-pjpq-2w7h.json", "id": "GHSA-4p8p-pjpq-2w7h", "packages": ["@tsparticles/mcp-server"], "path": "advisories/github-reviewed/2026/11/GHSA-4p8p-pjpq-2w7h/GHSA-4p8p-pjpq-2w7h.json", "severity": "HIGH", "status": "published", "summary": "tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process"}, {"advisory": "https://github.com/advisories/GHSA-h7c4-q426-7jh9", "aliases": ["CVE-2026-76893"], "commit": "https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/11/GHSA-h7c4-q426-7jh9/GHSA-h7c4-q426-7jh9.json", "id": "GHSA-h7c4-q426-7jh9", "packages": ["@tsparticles/mcp-server"], "path": "advisories/github-reviewed/2026/11/GHSA-h7c4-q426-7jh9/GHSA-h7c4-q426-7jh9.json", "severity": "MODERATE", "status": "published", "summary": "tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients"}, {"advisory": "https://github.com/advisories/GHSA-39wr-7q6h-cf68", "aliases": ["CVE-2026-123818"], "commit": "https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/09/GHSA-39wr-7q6h-cf68/GHSA-39wr-7q6h-cf68.json", "id": "GHSA-39wr-7q6h-cf68", "packages": ["lmdeploy"], "path": "advisories/github-reviewed/2026/09/GHSA-39wr-7q6h-cf68/GHSA-39wr-7q6h-cf68.json", "severity": "HIGH", "status": "changed", "summary": "LMDeploy has an SSRF bypass"}, {"advisory": "https://github.com/advisories/GHSA-2g87-pp6c-29x5", "aliases": ["CVE-2026-123817"], "commit": "https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/10/GHSA-2g87-pp6c-29x5/GHSA-2g87-pp6c-29x5.json", "id": "GHSA-2g87-pp6c-29x5", "packages": ["aiohttp"], "path": "advisories/github-reviewed/2026/10/GHSA-2g87-pp6c-29x5/GHSA-2g87-pp6c-29x5.json", "severity": "HIGH", "status": "changed", "summary": "aiohttp: Multiple instances of excessive or unbounded memory/CPU use"}, {"advisory": "https://github.com/advisories/GHSA-56x6-q882-mf27", "aliases": ["CVE-2026-77463"], "commit": "https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/11/GHSA-56x6-q882-mf27/GHSA-56x6-q882-mf27.json", "id": "GHSA-56x6-q882-mf27", "packages": ["github.com/umputun/remark42/backend", "github.com/umputun/remark42"], "path": "advisories/github-reviewed/2026/11/GHSA-56x6-q882-mf27/GHSA-56x6-q882-mf27.json", "severity": "MODERATE", "status": "published", "summary": "Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment"}, {"advisory": "https://github.com/advisories/GHSA-q4xm-p75h-h9p3", "aliases": ["CVE-2026-62662"], "commit": "https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/11/GHSA-q4xm-p75h-h9p3/GHSA-q4xm-p75h-h9p3.json", "id": "GHSA-q4xm-p75h-h9p3", "packages": ["github.com/pocket-id/pocket-id/backend"], "path": "advisories/github-reviewed/2026/11/GHSA-q4xm-p75h-h9p3/GHSA-q4xm-p75h-h9p3.json", "severity": "HIGH", "status": "published", "summary": "Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences"}, {"advisory": "https://github.com/advisories/GHSA-92hv-j533-69wc", "aliases": ["CVE-2026-125105"], "commit": "https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-92hv-j533-69wc/GHSA-92hv-j533-69wc.json", "id": "GHSA-92hv-j533-69wc", "packages": ["wagtail"], "path": "advisories/github-reviewed/2026/08/GHSA-92hv-j533-69wc/GHSA-92hv-j533-69wc.json", "severity": "LOW", "status": "changed", "summary": "Wagtail: Identification of documents by SHA1 hash"}, {"advisory": "https://github.com/advisories/GHSA-jm5p-837g-rv8g", "aliases": ["CVE-2026-125106"], "commit": "https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-jm5p-837g-rv8g/GHSA-jm5p-837g-rv8g.json", "id": "GHSA-jm5p-837g-rv8g", "packages": ["wagtail"], "path": "advisories/github-reviewed/2026/08/GHSA-jm5p-837g-rv8g/GHSA-jm5p-837g-rv8g.json", "severity": "MODERATE", "status": "changed", "summary": "Wagtail: Improper restriction handling on Page translation API endpoint"}, {"advisory": "https://github.com/advisories/GHSA-x5cx-w6p2-mxf2", "aliases": ["CVE-2026-123819"], "commit": "https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-x5cx-w6p2-mxf2/GHSA-x5cx-w6p2-mxf2.json", "id": "GHSA-x5cx-w6p2-mxf2", "packages": ["wagtail"], "path": "advisories/github-reviewed/2026/08/GHSA-x5cx-w6p2-mxf2/GHSA-x5cx-w6p2-mxf2.json", "severity": "MODERATE", "status": "changed", "summary": "Wagtail: Improper permission handling when copying snippets"}, {"advisory": "https://github.com/advisories/GHSA-vvr2-h2jp-838m", "aliases": ["CVE-2026-77604"], "commit": "https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/11/GHSA-vvr2-h2jp-838m/GHSA-vvr2-h2jp-838m.json", "id": "GHSA-vvr2-h2jp-838m", "packages": ["code-graph-rag"], "path": "advisories/github-reviewed/2026/11/GHSA-vvr2-h2jp-838m/GHSA-vvr2-h2jp-838m.json", "severity": "HIGH", "status": "published", "summary": "Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read"}, {"advisory": "https://github.com/advisories/GHSA-fhp4-pr5j-46m5", "aliases": ["CVE-2026-125107"], "commit": "https://github.com/github/advisory-database/commit/81569964abbda58f1f1d15a2dcbd97e7b0834cb6", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/81569964abbda58f1f1d15a2dcbd97e7b0834cb6/advisories/github-reviewed/2026/06/GHSA-fhp4-pr5j-46m5/GHSA-fhp4-pr5j-46m5.json", "id": "GHSA-fhp4-pr5j-46m5", "packages": ["muhammara"], "path": "advisories/github-reviewed/2026/06/GHSA-fhp4-pr5j-46m5/GHSA-fhp4-pr5j-46m5.json", "severity": "HIGH", "status": "changed", "summary": "Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key"}, {"advisory": "https://github.com/advisories/GHSA-rrh3-cwwj-g5mg", "aliases": ["CVE-2026-43637"], "commit": "https://github.com/github/advisory-database/commit/f953a301e2218bac05e58fd9b70f8a2f3b903eb8", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f953a301e2218bac05e58fd9b70f8a2f3b903eb8/advisories/github-reviewed/2026/07/GHSA-rrh3-cwwj-g5mg/GHSA-rrh3-cwwj-g5mg.json", "id": "GHSA-rrh3-cwwj-g5mg", "packages": ["cornac"], "path": "advisories/github-reviewed/2026/07/GHSA-rrh3-cwwj-g5mg/GHSA-rrh3-cwwj-g5mg.json", "severity": "HIGH", "status": "changed", "summary": "Cornac: Path Traversal via _extract_archive() in download.py"}, {"advisory": "https://github.com/advisories/GHSA-m27g-v28p-f9fx", "aliases": ["CVE-2026-63183"], "commit": "https://github.com/github/advisory-database/commit/c8192f690a9aae85b462b4fde4315042d4e03a32", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/c8192f690a9aae85b462b4fde4315042d4e03a32/advisories/github-reviewed/2026/11/GHSA-m27g-v28p-f9fx/GHSA-m27g-v28p-f9fx.json", "id": "GHSA-m27g-v28p-f9fx", "packages": ["omniauth"], "path": "advisories/github-reviewed/2026/11/GHSA-m27g-v28p-f9fx/GHSA-m27g-v28p-f9fx.json", "severity": "MODERATE", "status": "published", "summary": "OmniAuth: Host Header Injection Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-rr8v-fxxf-c986", "aliases": ["CVE-2026-75598"], "commit": "https://github.com/github/advisory-database/commit/c8192f690a9aae85b462b4fde4315042d4e03a32", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/c8192f690a9aae85b462b4fde4315042d4e03a32/advisories/github-reviewed/2026/11/GHSA-rr8v-fxxf-c986/GHSA-rr8v-fxxf-c986.json", "id": "GHSA-rr8v-fxxf-c986", "packages": ["com.gradleup.shadow:com.gradleup.shadow.gradle.plugin"], "path": "advisories/github-reviewed/2026/11/GHSA-rr8v-fxxf-c986/GHSA-rr8v-fxxf-c986.json", "severity": "HIGH", "status": "published", "summary": "Gradle Shadow: Zip Slip path traversal in ShadowCopyAction \u2014 no independent entry-name sanitization"}, {"advisory": "https://github.com/advisories/GHSA-wchh-mrv2-5h4q", "aliases": ["CVE-2026-86041"], "commit": "https://github.com/github/advisory-database/commit/111b791fd306825d640b789c94e7ac4ee74f09d9", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/111b791fd306825d640b789c94e7ac4ee74f09d9/advisories/github-reviewed/2026/11/GHSA-wchh-mrv2-5h4q/GHSA-wchh-mrv2-5h4q.json", "id": "GHSA-wchh-mrv2-5h4q", "packages": ["github.com/mayswind/ezbookkeeping"], "path": "advisories/github-reviewed/2026/11/GHSA-wchh-mrv2-5h4q/GHSA-wchh-mrv2-5h4q.json", "severity": "MODERATE", "status": "published", "summary": "ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header"}, {"advisory": "https://github.com/advisories/GHSA-f42p-wjw5-97qh", "aliases": ["CVE-2026-102289"], "commit": "https://github.com/github/advisory-database/commit/ab28e9fdeefc6dbd6985d8ace1bd9b62eb4c8c7d", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ab28e9fdeefc6dbd6985d8ace1bd9b62eb4c8c7d/advisories/github-reviewed/2026/11/GHSA-f42p-wjw5-97qh/GHSA-f42p-wjw5-97qh.json", "id": "GHSA-f42p-wjw5-97qh", "packages": ["zizmor"], "path": "advisories/github-reviewed/2026/11/GHSA-f42p-wjw5-97qh/GHSA-f42p-wjw5-97qh.json", "severity": "HIGH", "status": "published", "summary": "zizmor: Debug logging prints available GitHub credentials in cleartext"}, {"advisory": "https://github.com/advisories/GHSA-6j3h-rp73-6rvf", "aliases": ["CVE-2026-102339"], "commit": "https://github.com/github/advisory-database/commit/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3/advisories/github-reviewed/2026/11/GHSA-6j3h-rp73-6rvf/GHSA-6j3h-rp73-6rvf.json", "id": "GHSA-6j3h-rp73-6rvf", "packages": ["github.com/telepresenceio/telepresence/v2"], "path": "advisories/github-reviewed/2026/11/GHSA-6j3h-rp73-6rvf/GHSA-6j3h-rp73-6rvf.json", "severity": "HIGH", "status": "published", "summary": "Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof \u2014 active client sessions hijackable"}, {"advisory": "https://github.com/advisories/GHSA-j8j4-rw65-56r6", "aliases": ["CVE-2026-102340"], "commit": "https://github.com/github/advisory-database/commit/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3/advisories/github-reviewed/2026/11/GHSA-j8j4-rw65-56r6/GHSA-j8j4-rw65-56r6.json", "id": "GHSA-j8j4-rw65-56r6", "packages": ["github.com/telepresenceio/telepresence"], "path": "advisories/github-reviewed/2026/11/GHSA-j8j4-rw65-56r6/GHSA-j8j4-rw65-56r6.json", "severity": "HIGH", "status": "published", "summary": "Telepresence: Traffic Manager gRPC has no auth \u2014 any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets"}, {"advisory": "https://github.com/advisories/GHSA-9vhv-g5hf-m7m7", "aliases": ["CVE-2026-102610"], "commit": "https://github.com/github/advisory-database/commit/654347603de3b8fe2c8c5a49b41c8243f532bfef", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/654347603de3b8fe2c8c5a49b41c8243f532bfef/advisories/github-reviewed/2026/11/GHSA-9vhv-g5hf-m7m7/GHSA-9vhv-g5hf-m7m7.json", "id": "GHSA-9vhv-g5hf-m7m7", "packages": ["fast-agent-mcp"], "path": "advisories/github-reviewed/2026/11/GHSA-9vhv-g5hf-m7m7/GHSA-9vhv-g5hf-m7m7.json", "severity": "MODERATE", "status": "published", "summary": "fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution"}, {"advisory": "https://github.com/advisories/GHSA-g3c2-rjq2-c763", "aliases": ["CVE-2026-102657"], "commit": "https://github.com/github/advisory-database/commit/654347603de3b8fe2c8c5a49b41c8243f532bfef", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/654347603de3b8fe2c8c5a49b41c8243f532bfef/advisories/github-reviewed/2026/11/GHSA-g3c2-rjq2-c763/GHSA-g3c2-rjq2-c763.json", "id": "GHSA-g3c2-rjq2-c763", "packages": ["github.com/esm-dev/esm.sh/web"], "path": "advisories/github-reviewed/2026/11/GHSA-g3c2-rjq2-c763/GHSA-g3c2-rjq2-c763.json", "severity": "HIGH", "status": "published", "summary": "esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal"}, {"advisory": "https://github.com/advisories/GHSA-cp25-j9x5-p5xm", "aliases": ["CVE-2026-103022"], "commit": "https://github.com/github/advisory-database/commit/f2ea90cf42894cc778a695995921b7824e6b37c9", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f2ea90cf42894cc778a695995921b7824e6b37c9/advisories/github-reviewed/2026/11/GHSA-cp25-j9x5-p5xm/GHSA-cp25-j9x5-p5xm.json", "id": "GHSA-cp25-j9x5-p5xm", "packages": ["urwid"], "path": "advisories/github-reviewed/2026/11/GHSA-cp25-j9x5-p5xm/GHSA-cp25-j9x5-p5xm.json", "severity": "MODERATE", "status": "published", "summary": "Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)"}, {"advisory": "https://github.com/advisories/GHSA-xjw9-38cr-6372", "aliases": ["CVE-2026-125112"], "commit": "https://github.com/github/advisory-database/commit/adcc6836465885f35df6365de66c1b8ebb7bd8dd", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/adcc6836465885f35df6365de66c1b8ebb7bd8dd/advisories/github-reviewed/2026/09/GHSA-xjw9-38cr-6372/GHSA-xjw9-38cr-6372.json", "id": "GHSA-xjw9-38cr-6372", "packages": ["djust"], "path": "advisories/github-reviewed/2026/09/GHSA-xjw9-38cr-6372/GHSA-xjw9-38cr-6372.json", "severity": "HIGH", "status": "changed", "summary": "djust: A template binding inherits a context safety grant it never earned (XSS)"}, {"advisory": "https://github.com/advisories/GHSA-vj8v-p5vw-m6v5", "aliases": ["CVE-2026-125113"], "commit": "https://github.com/github/advisory-database/commit/403f74092fc8c07ed25c9eebd116dbcccce3ca39", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/403f74092fc8c07ed25c9eebd116dbcccce3ca39/advisories/github-reviewed/2026/04/GHSA-vj8v-p5vw-m6v5/GHSA-vj8v-p5vw-m6v5.json", "id": "GHSA-vj8v-p5vw-m6v5", "packages": ["xrootd"], "path": "advisories/github-reviewed/2026/04/GHSA-vj8v-p5vw-m6v5/GHSA-vj8v-p5vw-m6v5.json", "severity": "MODERATE", "status": "changed", "summary": "xrootd has path traversal in directory listing that allows access to the parent directory via trailing \"..\" pattern"}, {"advisory": "https://github.com/advisories/GHSA-rm8c-2cv8-jwf6", "aliases": ["CVE-2026-115770"], "commit": "https://github.com/github/advisory-database/commit/403f74092fc8c07ed25c9eebd116dbcccce3ca39", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/403f74092fc8c07ed25c9eebd116dbcccce3ca39/advisories/github-reviewed/2026/11/GHSA-rm8c-2cv8-jwf6/GHSA-rm8c-2cv8-jwf6.json", "id": "GHSA-rm8c-2cv8-jwf6", "packages": ["github.com/pocket-id/pocket-id/backend"], "path": "advisories/github-reviewed/2026/11/GHSA-rm8c-2cv8-jwf6/GHSA-rm8c-2cv8-jwf6.json", "severity": "CRITICAL", "status": "published", "summary": "Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing"}, {"advisory": "https://github.com/advisories/GHSA-4x48-cgf9-q33f", "aliases": ["CVE-2026-125114"], "commit": "https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/04/GHSA-4x48-cgf9-q33f/GHSA-4x48-cgf9-q33f.json", "id": "GHSA-4x48-cgf9-q33f", "packages": ["@novu/api"], "path": "advisories/github-reviewed/2026/04/GHSA-4x48-cgf9-q33f/GHSA-4x48-cgf9-q33f.json", "severity": "HIGH", "status": "changed", "summary": "Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection"}, {"advisory": "https://github.com/advisories/GHSA-vg6v-j97m-h5xq", "aliases": ["CVE-2026-125115"], "commit": "https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/07/GHSA-vg6v-j97m-h5xq/GHSA-vg6v-j97m-h5xq.json", "id": "GHSA-vg6v-j97m-h5xq", "packages": ["@novu/application-generic"], "path": "advisories/github-reviewed/2026/07/GHSA-vg6v-j97m-h5xq/GHSA-vg6v-j97m-h5xq.json", "severity": "MODERATE", "status": "changed", "summary": "@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations \u2014 affects Workflow HTTP request step + Webhook filter condition"}, {"advisory": "https://github.com/advisories/GHSA-85gg-2gfq-q95m", "aliases": ["CVE-2026-87008"], "commit": "https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/11/GHSA-85gg-2gfq-q95m/GHSA-85gg-2gfq-q95m.json", "id": "GHSA-85gg-2gfq-q95m", "packages": ["code-graph-rag"], "path": "advisories/github-reviewed/2026/11/GHSA-85gg-2gfq-q95m/GHSA-85gg-2gfq-q95m.json", "severity": "HIGH", "status": "published", "summary": "Code Graph RAG structural tools follow out-of-root symlinks"}, {"advisory": "https://github.com/advisories/GHSA-f74m-x83r-c4v4", "aliases": ["CVE-2026-94618"], "commit": "https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/11/GHSA-f74m-x83r-c4v4/GHSA-f74m-x83r-c4v4.json", "id": "GHSA-f74m-x83r-c4v4", "packages": ["filegator/filegator"], "path": "advisories/github-reviewed/2026/11/GHSA-f74m-x83r-c4v4/GHSA-f74m-x83r-c4v4.json", "severity": "MODERATE", "status": "published", "summary": "FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive"}, {"advisory": "https://github.com/advisories/GHSA-gj9m-f8ph-pmhr", "aliases": ["CVE-2026-102895"], "commit": "https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/11/GHSA-gj9m-f8ph-pmhr/GHSA-gj9m-f8ph-pmhr.json", "id": "GHSA-gj9m-f8ph-pmhr", "packages": ["gpustack"], "path": "advisories/github-reviewed/2026/11/GHSA-gj9m-f8ph-pmhr/GHSA-gj9m-f8ph-pmhr.json", "severity": "CRITICAL", "status": "published", "summary": "GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin"}, {"advisory": "https://github.com/advisories/GHSA-44r8-3p76-84mw", "aliases": ["CVE-2026-94619"], "commit": "https://github.com/github/advisory-database/commit/1021228fec7b44218a3e9ac6d9a899d13eb5dd26", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/1021228fec7b44218a3e9ac6d9a899d13eb5dd26/advisories/github-reviewed/2026/11/GHSA-44r8-3p76-84mw/GHSA-44r8-3p76-84mw.json", "id": "GHSA-44r8-3p76-84mw", "packages": ["filegator/filegator"], "path": "advisories/github-reviewed/2026/11/GHSA-44r8-3p76-84mw/GHSA-44r8-3p76-84mw.json", "severity": "MODERATE", "status": "published", "summary": "FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files"}, {"advisory": "https://github.com/advisories/GHSA-9qq5-422f-33c2", "aliases": ["CVE-2026-85737"], "commit": "https://github.com/github/advisory-database/commit/b3734c9c566052b56be1a4d31d75f5a5620c6f46", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/b3734c9c566052b56be1a4d31d75f5a5620c6f46/advisories/github-reviewed/2026/11/GHSA-9qq5-422f-33c2/GHSA-9qq5-422f-33c2.json", "id": "GHSA-9qq5-422f-33c2", "packages": ["www.velocidex.com/golang/velociraptor"], "path": "advisories/github-reviewed/2026/11/GHSA-9qq5-422f-33c2/GHSA-9qq5-422f-33c2.json", "severity": "MODERATE", "status": "published", "summary": "Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin"}, {"advisory": "https://github.com/advisories/GHSA-rjr3-43j3-4q8g", "aliases": ["CVE-2026-77596"], "commit": "https://github.com/github/advisory-database/commit/b3734c9c566052b56be1a4d31d75f5a5620c6f46", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/b3734c9c566052b56be1a4d31d75f5a5620c6f46/advisories/github-reviewed/2026/11/GHSA-rjr3-43j3-4q8g/GHSA-rjr3-43j3-4q8g.json", "id": "GHSA-rjr3-43j3-4q8g", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-rjr3-43j3-4q8g/GHSA-rjr3-43j3-4q8g.json", "severity": "CRITICAL", "status": "published", "summary": "Kubeflow Pipelines API server lacks authorization for shared pipeline uploads"}, {"advisory": "https://github.com/advisories/GHSA-h89v-g948-47vp", "aliases": ["CVE-2026-97705"], "commit": "https://github.com/github/advisory-database/commit/be7ccaaa5a50cc26fa0f3d9a09a099f55ed875b3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/be7ccaaa5a50cc26fa0f3d9a09a099f55ed875b3/advisories/github-reviewed/2026/11/GHSA-h89v-g948-47vp/GHSA-h89v-g948-47vp.json", "id": "GHSA-h89v-g948-47vp", "packages": ["moleculer"], "path": "advisories/github-reviewed/2026/11/GHSA-h89v-g948-47vp/GHSA-h89v-g948-47vp.json", "severity": "HIGH", "status": "published", "summary": "Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser"}, {"advisory": "https://github.com/advisories/GHSA-9hq4-hm3j-jmph", "aliases": ["CVE-2026-108262"], "commit": "https://github.com/github/advisory-database/commit/a645cef65b99e828b26daf2d6ada08e377d0fc46", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/a645cef65b99e828b26daf2d6ada08e377d0fc46/advisories/github-reviewed/2026/11/GHSA-9hq4-hm3j-jmph/GHSA-9hq4-hm3j-jmph.json", "id": "GHSA-9hq4-hm3j-jmph", "packages": ["github.com/ddev/ddev"], "path": "advisories/github-reviewed/2026/11/GHSA-9hq4-hm3j-jmph/GHSA-9hq4-hm3j-jmph.json", "severity": "HIGH", "status": "published", "summary": "DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885"}, {"advisory": "https://github.com/advisories/GHSA-x89h-7h96-v88f", "aliases": ["CVE-2026-119298"], "commit": "https://github.com/github/advisory-database/commit/9b78091ed0ea840196837517e432707a26665b76", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/9b78091ed0ea840196837517e432707a26665b76/advisories/github-reviewed/2026/11/GHSA-x89h-7h96-v88f/GHSA-x89h-7h96-v88f.json", "id": "GHSA-x89h-7h96-v88f", "packages": ["github.com/schollz/croc/v11", "github.com/schollz/croc/v10", "github.com/schollz/croc/v9", "github.com/schollz/croc/v8", "github.com/schollz/croc/v6", "github.com/schollz/croc"], "path": "advisories/github-reviewed/2026/11/GHSA-x89h-7h96-v88f/GHSA-x89h-7h96-v88f.json", "severity": "MODERATE", "status": "published", "summary": "croc: Overwrite-confirmation bypass via a crafted \"croc-stdin-\" filename on receive"}, {"advisory": "https://github.com/advisories/GHSA-2xwh-426q-42c5", "aliases": ["CVE-2026-88982"], "commit": "https://github.com/github/advisory-database/commit/75510e9a2edc82ec797fb06fceb055682b7dda1a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/75510e9a2edc82ec797fb06fceb055682b7dda1a/advisories/github-reviewed/2026/11/GHSA-2xwh-426q-42c5/GHSA-2xwh-426q-42c5.json", "id": "GHSA-2xwh-426q-42c5", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-2xwh-426q-42c5/GHSA-2xwh-426q-42c5.json", "severity": "MODERATE", "status": "published", "summary": "Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)"}, {"advisory": "https://github.com/advisories/GHSA-5xjx-9qx6-jcrv", "aliases": ["CVE-2026-88968"], "commit": "https://github.com/github/advisory-database/commit/75510e9a2edc82ec797fb06fceb055682b7dda1a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/75510e9a2edc82ec797fb06fceb055682b7dda1a/advisories/github-reviewed/2026/11/GHSA-5xjx-9qx6-jcrv/GHSA-5xjx-9qx6-jcrv.json", "id": "GHSA-5xjx-9qx6-jcrv", "packages": ["@anthropic-ai/claude-code"], "path": "advisories/github-reviewed/2026/11/GHSA-5xjx-9qx6-jcrv/GHSA-5xjx-9qx6-jcrv.json", "severity": "HIGH", "status": "published", "summary": "Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace"}, {"advisory": "https://github.com/advisories/GHSA-f7vj-6669-qvv4", "aliases": ["CVE-2026-88983"], "commit": "https://github.com/github/advisory-database/commit/75510e9a2edc82ec797fb06fceb055682b7dda1a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/75510e9a2edc82ec797fb06fceb055682b7dda1a/advisories/github-reviewed/2026/11/GHSA-f7vj-6669-qvv4/GHSA-f7vj-6669-qvv4.json", "id": "GHSA-f7vj-6669-qvv4", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-f7vj-6669-qvv4/GHSA-f7vj-6669-qvv4.json", "severity": "MODERATE", "status": "published", "summary": "Kubeflow Pipelines \u2014 API server fetches a caller-supplied pipelineURL without host validation"}, {"advisory": "https://github.com/advisories/GHSA-ghgh-57qv-h687", "aliases": ["CVE-2026-88984"], "commit": "https://github.com/github/advisory-database/commit/43c949c0bc85a8bbc7c12c7391bbc0f4879c093e", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/43c949c0bc85a8bbc7c12c7391bbc0f4879c093e/advisories/github-reviewed/2026/11/GHSA-ghgh-57qv-h687/GHSA-ghgh-57qv-h687.json", "id": "GHSA-ghgh-57qv-h687", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-ghgh-57qv-h687/GHSA-ghgh-57qv-h687.json", "severity": "HIGH", "status": "published", "summary": "Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines"}, {"advisory": "https://github.com/advisories/GHSA-gcwf-c25f-p9rv", "aliases": ["CVE-2026-77433"], "commit": "https://github.com/github/advisory-database/commit/ef91dcbf209cbe30c5e979992aaf24803187a43a", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ef91dcbf209cbe30c5e979992aaf24803187a43a/advisories/github-reviewed/2026/11/GHSA-gcwf-c25f-p9rv/GHSA-gcwf-c25f-p9rv.json", "id": "GHSA-gcwf-c25f-p9rv", "packages": ["kiwitcms"], "path": "advisories/github-reviewed/2026/11/GHSA-gcwf-c25f-p9rv/GHSA-gcwf-c25f-p9rv.json", "severity": "MODERATE", "status": "published", "summary": "Kiwi TCMS account confirmation open redirect through protocol-relative URLs"}, {"advisory": "https://github.com/advisories/GHSA-g3qx-frcg-j979", "aliases": ["CVE-2026-88986"], "commit": "https://github.com/github/advisory-database/commit/ffd82943a698aa62aed95bcc199eb036dc53c899", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/ffd82943a698aa62aed95bcc199eb036dc53c899/advisories/github-reviewed/2026/11/GHSA-g3qx-frcg-j979/GHSA-g3qx-frcg-j979.json", "id": "GHSA-g3qx-frcg-j979", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-g3qx-frcg-j979/GHSA-g3qx-frcg-j979.json", "severity": "MODERATE", "status": "published", "summary": "Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses"}, {"advisory": "https://github.com/advisories/GHSA-r4mx-2gr2-8277", "aliases": ["CVE-2026-88985"], "commit": "https://github.com/github/advisory-database/commit/ffd82943a698aa62aed95bcc199eb036dc53c899", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/ffd82943a698aa62aed95bcc199eb036dc53c899/advisories/github-reviewed/2026/11/GHSA-r4mx-2gr2-8277/GHSA-r4mx-2gr2-8277.json", "id": "GHSA-r4mx-2gr2-8277", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-r4mx-2gr2-8277/GHSA-r4mx-2gr2-8277.json", "severity": "MODERATE", "status": "published", "summary": "Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server"}], "sourceId": "advisories-reviewed", "text": "On November 9, 2026, GitHub's security advisory list published 45 new advisories, changed 23, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 47895, "fingerprint": "bcf53050c596fae2cafe33522c1642f2a6fdc220ec6cdcf41d282a61e3afd0ef", "url": "https://flarereef.flareforward.com/files/watch/bcf53050c596fae2cafe33522c1642f2a6fdc220ec6cdcf41d282a61e3afd0ef.json"}}}, "parsed": {"counts": {"changed": 23, "published": 45, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-09", "kind": "watch-day", "recordedAt": "2026-11-10T01:25:52Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-rfx3-98h7-v3xp", "aliases": ["CVE-2026-75513"], "commit": "https://github.com/github/advisory-database/commit/fec901422fe97937357912b981bd684ceb90ed90", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/fec901422fe97937357912b981bd684ceb90ed90/advisories/github-reviewed/2026/09/GHSA-rfx3-98h7-v3xp/GHSA-rfx3-98h7-v3xp.json", "id": "GHSA-rfx3-98h7-v3xp", "packages": ["Marten"], "path": "advisories/github-reviewed/2026/09/GHSA-rfx3-98h7-v3xp/GHSA-rfx3-98h7-v3xp.json", "severity": "CRITICAL", "status": "changed", "summary": "Marten's LINQ provider has SQL injection via unescaped string literals"}, {"advisory": "https://github.com/advisories/GHSA-8fxw-fmj8-xp7j", "aliases": ["CVE-2026-88023"], "commit": "https://github.com/github/advisory-database/commit/ee60ae9a10bde8d40f03690f90e8e05ae96b4cc7", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/ee60ae9a10bde8d40f03690f90e8e05ae96b4cc7/advisories/github-reviewed/2026/10/GHSA-8fxw-fmj8-xp7j/GHSA-8fxw-fmj8-xp7j.json", "id": "GHSA-8fxw-fmj8-xp7j", "packages": ["mongodb/mongodb"], "path": "advisories/github-reviewed/2026/10/GHSA-8fxw-fmj8-xp7j/GHSA-8fxw-fmj8-xp7j.json", "severity": "MODERATE", "status": "changed", "summary": "MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs"}, {"advisory": "https://github.com/advisories/GHSA-w7qv-268h-9h3f", "aliases": ["CVE-2026-63417"], "commit": "https://github.com/github/advisory-database/commit/187275eb1a5f35244190c0102764fde701eca3e9", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/187275eb1a5f35244190c0102764fde701eca3e9/advisories/github-reviewed/2026/11/GHSA-w7qv-268h-9h3f/GHSA-w7qv-268h-9h3f.json", "id": "GHSA-w7qv-268h-9h3f", "packages": ["loggingredactor"], "path": "advisories/github-reviewed/2026/11/GHSA-w7qv-268h-9h3f/GHSA-w7qv-268h-9h3f.json", "severity": "HIGH", "status": "published", "summary": "Logging Redactor: PII data in str/repr of non primitive objects was not being redacted"}, {"advisory": "https://github.com/advisories/GHSA-52c6-99qm-3hqr", "aliases": ["CVE-2026-63436"], "commit": "https://github.com/github/advisory-database/commit/a7fb05fbd5da52032db351e072f8da48488ad30c", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/a7fb05fbd5da52032db351e072f8da48488ad30c/advisories/github-reviewed/2026/11/GHSA-52c6-99qm-3hqr/GHSA-52c6-99qm-3hqr.json", "id": "GHSA-52c6-99qm-3hqr", "packages": ["org.zeroturnaround:zt-zip"], "path": "advisories/github-reviewed/2026/11/GHSA-52c6-99qm-3hqr/GHSA-52c6-99qm-3hqr.json", "severity": "HIGH", "status": "published", "summary": "zt-zip: Path traversal in fluent API unpack"}, {"advisory": "https://github.com/advisories/GHSA-h667-4jj2-cgv4", "aliases": ["CVE-2026-63470"], "commit": "https://github.com/github/advisory-database/commit/bc1817f9e59d4d1c85b11fc97dd5c357de13aaa7", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/bc1817f9e59d4d1c85b11fc97dd5c357de13aaa7/advisories/github-reviewed/2026/11/GHSA-h667-4jj2-cgv4/GHSA-h667-4jj2-cgv4.json", "id": "GHSA-h667-4jj2-cgv4", "packages": ["fastapi-code-generator"], "path": "advisories/github-reviewed/2026/11/GHSA-h667-4jj2-cgv4/GHSA-h667-4jj2-cgv4.json", "severity": "CRITICAL", "status": "published", "summary": "fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring"}, {"advisory": "https://github.com/advisories/GHSA-6xmv-cjr5-w3q8", "aliases": ["CVE-2026-63469"], "commit": "https://github.com/github/advisory-database/commit/d67dc8470512c823300addf219feafd74338ed5b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/d67dc8470512c823300addf219feafd74338ed5b/advisories/github-reviewed/2026/11/GHSA-6xmv-cjr5-w3q8/GHSA-6xmv-cjr5-w3q8.json", "id": "GHSA-6xmv-cjr5-w3q8", "packages": ["fastapi-code-generator"], "path": "advisories/github-reviewed/2026/11/GHSA-6xmv-cjr5-w3q8/GHSA-6xmv-cjr5-w3q8.json", "severity": "CRITICAL", "status": "published", "summary": "fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict"}, {"advisory": "https://github.com/advisories/GHSA-p2mm-64f6-gmpp", "aliases": ["CVE-2026-63471"], "commit": "https://github.com/github/advisory-database/commit/d8fce65f49add7b6da1940cb7274d618be330da0", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/d8fce65f49add7b6da1940cb7274d618be330da0/advisories/github-reviewed/2026/11/GHSA-p2mm-64f6-gmpp/GHSA-p2mm-64f6-gmpp.json", "id": "GHSA-p2mm-64f6-gmpp", "packages": ["fastapi-code-generator"], "path": "advisories/github-reviewed/2026/11/GHSA-p2mm-64f6-gmpp/GHSA-p2mm-64f6-gmpp.json", "severity": "CRITICAL", "status": "published", "summary": "fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator"}, {"advisory": "https://github.com/advisories/GHSA-9qw7-j9xw-fv9c", "aliases": ["CVE-2026-63395"], "commit": "https://github.com/github/advisory-database/commit/b18aaf9b65e2f55252957c08dfe5bba2bda70557", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b18aaf9b65e2f55252957c08dfe5bba2bda70557/advisories/github-reviewed/2026/11/GHSA-9qw7-j9xw-fv9c/GHSA-9qw7-j9xw-fv9c.json", "id": "GHSA-9qw7-j9xw-fv9c", "packages": ["isomorphic-git"], "path": "advisories/github-reviewed/2026/11/GHSA-9qw7-j9xw-fv9c/GHSA-9qw7-j9xw-fv9c.json", "severity": "HIGH", "status": "published", "summary": "isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE)"}, {"advisory": "https://github.com/advisories/GHSA-jwjp-4649-v8jp", "aliases": ["CVE-2026-123805"], "commit": "https://github.com/github/advisory-database/commit/1c4bca1757976e10298e422db396e1982531ebdf", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/1c4bca1757976e10298e422db396e1982531ebdf/advisories/github-reviewed/2026/08/GHSA-jwjp-4649-v8jp/GHSA-jwjp-4649-v8jp.json", "id": "GHSA-jwjp-4649-v8jp", "packages": ["SIPSorcery"], "path": "advisories/github-reviewed/2026/08/GHSA-jwjp-4649-v8jp/GHSA-jwjp-4649-v8jp.json", "severity": "HIGH", "status": "changed", "summary": "SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing"}, {"advisory": "https://github.com/advisories/GHSA-96wc-2m84-2cj7", "aliases": ["CVE-2026-63475"], "commit": "https://github.com/github/advisory-database/commit/4638fd6c99a1a8129739415b40661d33cd1f762b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/4638fd6c99a1a8129739415b40661d33cd1f762b/advisories/github-reviewed/2026/11/GHSA-96wc-2m84-2cj7/GHSA-96wc-2m84-2cj7.json", "id": "GHSA-96wc-2m84-2cj7", "packages": ["isomorphic-git"], "path": "advisories/github-reviewed/2026/11/GHSA-96wc-2m84-2cj7/GHSA-96wc-2m84-2cj7.json", "severity": "MODERATE", "status": "published", "summary": "isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)"}, {"advisory": "https://github.com/advisories/GHSA-cw2g-2vwq-88w6", "aliases": ["CVE-2026-63478"], "commit": "https://github.com/github/advisory-database/commit/0f109e5ef0d3bf352aa03e494d13edd84920ecc7", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/0f109e5ef0d3bf352aa03e494d13edd84920ecc7/advisories/github-reviewed/2026/11/GHSA-cw2g-2vwq-88w6/GHSA-cw2g-2vwq-88w6.json", "id": "GHSA-cw2g-2vwq-88w6", "packages": ["isomorphic-git"], "path": "advisories/github-reviewed/2026/11/GHSA-cw2g-2vwq-88w6/GHSA-cw2g-2vwq-88w6.json", "severity": "MODERATE", "status": "published", "summary": "isomorphic-git: Path traversal via a \"..\" tree-entry name writes files outside the working directory on clone/checkout"}, {"advisory": "https://github.com/advisories/GHSA-qp9x-wp8f-qgjj", "aliases": ["CVE-2026-123806"], "commit": "https://github.com/github/advisory-database/commit/f10b20320c074faa1adba992e7cc44b62eb6f12b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f10b20320c074faa1adba992e7cc44b62eb6f12b/advisories/github-reviewed/2026/05/GHSA-qp9x-wp8f-qgjj/GHSA-qp9x-wp8f-qgjj.json", "id": "GHSA-qp9x-wp8f-qgjj", "packages": ["tuf"], "path": "advisories/github-reviewed/2026/05/GHSA-qp9x-wp8f-qgjj/GHSA-qp9x-wp8f-qgjj.json", "severity": "MODERATE", "status": "changed", "summary": "tuf has platform-dependent delegation path matching"}, {"advisory": "https://github.com/advisories/GHSA-4xm8-rg9h-jhq2", "aliases": ["CVE-2026-123807"], "commit": "https://github.com/github/advisory-database/commit/cfd604cb0ab6b56e205fad72b7f7d5b04583869f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/cfd604cb0ab6b56e205fad72b7f7d5b04583869f/advisories/github-reviewed/2026/10/GHSA-4xm8-rg9h-jhq2/GHSA-4xm8-rg9h-jhq2.json", "id": "GHSA-4xm8-rg9h-jhq2", "packages": ["signalk-server", "@signalk/resources-provider"], "path": "advisories/github-reviewed/2026/10/GHSA-4xm8-rg9h-jhq2/GHSA-4xm8-rg9h-jhq2.json", "severity": "CRITICAL", "status": "changed", "summary": "Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution"}, {"advisory": "https://github.com/advisories/GHSA-p74g-f95m-7fx7", "aliases": ["CVE-2026-63197"], "commit": "https://github.com/github/advisory-database/commit/03ce40e4060df762d53ee2f994002a8c0f096e17", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/03ce40e4060df762d53ee2f994002a8c0f096e17/advisories/github-reviewed/2026/11/GHSA-p74g-f95m-7fx7/GHSA-p74g-f95m-7fx7.json", "id": "GHSA-p74g-f95m-7fx7", "packages": ["github.com/traPtitech/traQ"], "path": "advisories/github-reviewed/2026/11/GHSA-p74g-f95m-7fx7/GHSA-p74g-f95m-7fx7.json", "severity": "HIGH", "status": "published", "summary": "traQ: XSS in the User Uploaded File Retrieval API"}, {"advisory": "https://github.com/advisories/GHSA-xrmj-5g4g-8987", "aliases": ["CVE-2026-123809"], "commit": "https://github.com/github/advisory-database/commit/517b1dfd255d57ee85dda6bde92abdad0ba31dc1", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/517b1dfd255d57ee85dda6bde92abdad0ba31dc1/advisories/github-reviewed/2026/07/GHSA-xrmj-5g4g-8987/GHSA-xrmj-5g4g-8987.json", "id": "GHSA-xrmj-5g4g-8987", "packages": ["@dynatrace-oss/dynatrace-mcp-server"], "path": "advisories/github-reviewed/2026/07/GHSA-xrmj-5g4g-8987/GHSA-xrmj-5g4g-8987.json", "severity": "MODERATE", "status": "changed", "summary": "@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification"}, {"advisory": "https://github.com/advisories/GHSA-8cfq-jgf7-8m27", "aliases": ["CVE-2026-63198"], "commit": "https://github.com/github/advisory-database/commit/517b1dfd255d57ee85dda6bde92abdad0ba31dc1", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/517b1dfd255d57ee85dda6bde92abdad0ba31dc1/advisories/github-reviewed/2026/11/GHSA-8cfq-jgf7-8m27/GHSA-8cfq-jgf7-8m27.json", "id": "GHSA-8cfq-jgf7-8m27", "packages": ["github.com/traPtitech/traQ"], "path": "advisories/github-reviewed/2026/11/GHSA-8cfq-jgf7-8m27/GHSA-8cfq-jgf7-8m27.json", "severity": "HIGH", "status": "published", "summary": "traQ: Privilege escalation by OAuth prompt=none request"}, {"advisory": "https://github.com/advisories/GHSA-pqh8-p93p-2rx7", "aliases": ["CVE-2026-123810"], "commit": "https://github.com/github/advisory-database/commit/5520d19b6b821e6c9bf2bd2315ee532fab225fe3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/5520d19b6b821e6c9bf2bd2315ee532fab225fe3/advisories/github-reviewed/2026/07/GHSA-pqh8-p93p-2rx7/GHSA-pqh8-p93p-2rx7.json", "id": "GHSA-pqh8-p93p-2rx7", "packages": ["@dynatrace-oss/dynatrace-mcp-server"], "path": "advisories/github-reviewed/2026/07/GHSA-pqh8-p93p-2rx7/GHSA-pqh8-p93p-2rx7.json", "severity": "MODERATE", "status": "changed", "summary": "@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL"}, {"advisory": "https://github.com/advisories/GHSA-p7w7-4929-vpj5", "aliases": ["CVE-2026-123811"], "commit": "https://github.com/github/advisory-database/commit/b6f283b1b6f012d834ca100a3464fc0ec6cd71e8", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b6f283b1b6f012d834ca100a3464fc0ec6cd71e8/advisories/github-reviewed/2026/07/GHSA-p7w7-4929-vpj5/GHSA-p7w7-4929-vpj5.json", "id": "GHSA-p7w7-4929-vpj5", "packages": ["@dynatrace-oss/dynatrace-mcp-server"], "path": "advisories/github-reviewed/2026/07/GHSA-p7w7-4929-vpj5/GHSA-p7w7-4929-vpj5.json", "severity": "HIGH", "status": "changed", "summary": "`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation"}, {"advisory": "https://github.com/advisories/GHSA-v2g6-7r9j-v6px", "aliases": ["CVE-2026-63499"], "commit": "https://github.com/github/advisory-database/commit/3d4058fecd81d20aaf6b63564c77bd766c6ce556", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/3d4058fecd81d20aaf6b63564c77bd766c6ce556/advisories/github-reviewed/2026/11/GHSA-v2g6-7r9j-v6px/GHSA-v2g6-7r9j-v6px.json", "id": "GHSA-v2g6-7r9j-v6px", "packages": ["org.zeroturnaround:zt-zip"], "path": "advisories/github-reviewed/2026/11/GHSA-v2g6-7r9j-v6px/GHSA-v2g6-7r9j-v6px.json", "severity": "MODERATE", "status": "published", "summary": "zt-zip: ZipUtil.unpack can change file permissions of output directory"}, {"advisory": "https://github.com/advisories/GHSA-jq7h-wrvp-3rgx", "aliases": ["CVE-2026-123813"], "commit": "https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/10/GHSA-jq7h-wrvp-3rgx/GHSA-jq7h-wrvp-3rgx.json", "id": "GHSA-jq7h-wrvp-3rgx", "packages": ["pyload-ng"], "path": "advisories/github-reviewed/2026/10/GHSA-jq7h-wrvp-3rgx/GHSA-jq7h-wrvp-3rgx.json", "severity": "HIGH", "status": "changed", "summary": "pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session"}, {"advisory": "https://github.com/advisories/GHSA-p3pr-8f3m-4qp8", "aliases": ["CVE-2026-123814"], "commit": "https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/10/GHSA-p3pr-8f3m-4qp8/GHSA-p3pr-8f3m-4qp8.json", "id": "GHSA-p3pr-8f3m-4qp8", "packages": ["pyload-ng"], "path": "advisories/github-reviewed/2026/10/GHSA-p3pr-8f3m-4qp8/GHSA-p3pr-8f3m-4qp8.json", "severity": "MODERATE", "status": "changed", "summary": "pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host"}, {"advisory": "https://github.com/advisories/GHSA-6w3r-6hpr-hp6p", "aliases": ["CVE-2026-63501"], "commit": "https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/11/GHSA-6w3r-6hpr-hp6p/GHSA-6w3r-6hpr-hp6p.json", "id": "GHSA-6w3r-6hpr-hp6p", "packages": ["ag-psd"], "path": "advisories/github-reviewed/2026/11/GHSA-6w3r-6hpr-hp6p/GHSA-6w3r-6hpr-hp6p.json", "severity": "HIGH", "status": "published", "summary": "ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)"}, {"advisory": "https://github.com/advisories/GHSA-fr26-jjhm-638c", "aliases": ["CVE-2026-123815"], "commit": "https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/10/GHSA-fr26-jjhm-638c/GHSA-fr26-jjhm-638c.json", "id": "GHSA-fr26-jjhm-638c", "packages": ["pyload-ng"], "path": "advisories/github-reviewed/2026/10/GHSA-fr26-jjhm-638c/GHSA-fr26-jjhm-638c.json", "severity": "HIGH", "status": "changed", "summary": "pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)"}, {"advisory": "https://github.com/advisories/GHSA-447x-qqwf-m7xq", "aliases": ["CVE-2026-63655"], "commit": "https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/11/GHSA-447x-qqwf-m7xq/GHSA-447x-qqwf-m7xq.json", "id": "GHSA-447x-qqwf-m7xq", "packages": ["@tsparticles/mcp-server"], "path": "advisories/github-reviewed/2026/11/GHSA-447x-qqwf-m7xq/GHSA-447x-qqwf-m7xq.json", "severity": "HIGH", "status": "published", "summary": "tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS"}, {"advisory": "https://github.com/advisories/GHSA-ghc9-756g-vrcv", "aliases": ["CVE-2026-59171"], "commit": "https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/11/GHSA-ghc9-756g-vrcv/GHSA-ghc9-756g-vrcv.json", "id": "GHSA-ghc9-756g-vrcv", "packages": ["org.json:json"], "path": "advisories/github-reviewed/2026/11/GHSA-ghc9-756g-vrcv/GHSA-ghc9-756g-vrcv.json", "severity": "MODERATE", "status": "published", "summary": "JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS"}, {"advisory": "https://github.com/advisories/GHSA-r44w-v6gf-x3p6", "aliases": ["CVE-2026-123816"], "commit": "https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/10/GHSA-r44w-v6gf-x3p6/GHSA-r44w-v6gf-x3p6.json", "id": "GHSA-r44w-v6gf-x3p6", "packages": ["pyload-ng"], "path": "advisories/github-reviewed/2026/10/GHSA-r44w-v6gf-x3p6/GHSA-r44w-v6gf-x3p6.json", "severity": "HIGH", "status": "changed", "summary": "pyLoad has an authentication bypass in API key validation (check_apikey cache)"}, {"advisory": "https://github.com/advisories/GHSA-4p8p-pjpq-2w7h", "aliases": ["CVE-2026-76892"], "commit": "https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/11/GHSA-4p8p-pjpq-2w7h/GHSA-4p8p-pjpq-2w7h.json", "id": "GHSA-4p8p-pjpq-2w7h", "packages": ["@tsparticles/mcp-server"], "path": "advisories/github-reviewed/2026/11/GHSA-4p8p-pjpq-2w7h/GHSA-4p8p-pjpq-2w7h.json", "severity": "HIGH", "status": "published", "summary": "tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process"}, {"advisory": "https://github.com/advisories/GHSA-h7c4-q426-7jh9", "aliases": ["CVE-2026-76893"], "commit": "https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/11/GHSA-h7c4-q426-7jh9/GHSA-h7c4-q426-7jh9.json", "id": "GHSA-h7c4-q426-7jh9", "packages": ["@tsparticles/mcp-server"], "path": "advisories/github-reviewed/2026/11/GHSA-h7c4-q426-7jh9/GHSA-h7c4-q426-7jh9.json", "severity": "MODERATE", "status": "published", "summary": "tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients"}, {"advisory": "https://github.com/advisories/GHSA-39wr-7q6h-cf68", "aliases": ["CVE-2026-123818"], "commit": "https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/09/GHSA-39wr-7q6h-cf68/GHSA-39wr-7q6h-cf68.json", "id": "GHSA-39wr-7q6h-cf68", "packages": ["lmdeploy"], "path": "advisories/github-reviewed/2026/09/GHSA-39wr-7q6h-cf68/GHSA-39wr-7q6h-cf68.json", "severity": "HIGH", "status": "changed", "summary": "LMDeploy has an SSRF bypass"}, {"advisory": "https://github.com/advisories/GHSA-2g87-pp6c-29x5", "aliases": ["CVE-2026-123817"], "commit": "https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/10/GHSA-2g87-pp6c-29x5/GHSA-2g87-pp6c-29x5.json", "id": "GHSA-2g87-pp6c-29x5", "packages": ["aiohttp"], "path": "advisories/github-reviewed/2026/10/GHSA-2g87-pp6c-29x5/GHSA-2g87-pp6c-29x5.json", "severity": "HIGH", "status": "changed", "summary": "aiohttp: Multiple instances of excessive or unbounded memory/CPU use"}, {"advisory": "https://github.com/advisories/GHSA-56x6-q882-mf27", "aliases": ["CVE-2026-77463"], "commit": "https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/11/GHSA-56x6-q882-mf27/GHSA-56x6-q882-mf27.json", "id": "GHSA-56x6-q882-mf27", "packages": ["github.com/umputun/remark42/backend", "github.com/umputun/remark42"], "path": "advisories/github-reviewed/2026/11/GHSA-56x6-q882-mf27/GHSA-56x6-q882-mf27.json", "severity": "MODERATE", "status": "published", "summary": "Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment"}, {"advisory": "https://github.com/advisories/GHSA-q4xm-p75h-h9p3", "aliases": ["CVE-2026-62662"], "commit": "https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/11/GHSA-q4xm-p75h-h9p3/GHSA-q4xm-p75h-h9p3.json", "id": "GHSA-q4xm-p75h-h9p3", "packages": ["github.com/pocket-id/pocket-id/backend"], "path": "advisories/github-reviewed/2026/11/GHSA-q4xm-p75h-h9p3/GHSA-q4xm-p75h-h9p3.json", "severity": "HIGH", "status": "published", "summary": "Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences"}, {"advisory": "https://github.com/advisories/GHSA-92hv-j533-69wc", "aliases": ["CVE-2026-125105"], "commit": "https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-92hv-j533-69wc/GHSA-92hv-j533-69wc.json", "id": "GHSA-92hv-j533-69wc", "packages": ["wagtail"], "path": "advisories/github-reviewed/2026/08/GHSA-92hv-j533-69wc/GHSA-92hv-j533-69wc.json", "severity": "LOW", "status": "changed", "summary": "Wagtail: Identification of documents by SHA1 hash"}, {"advisory": "https://github.com/advisories/GHSA-jm5p-837g-rv8g", "aliases": ["CVE-2026-125106"], "commit": "https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-jm5p-837g-rv8g/GHSA-jm5p-837g-rv8g.json", "id": "GHSA-jm5p-837g-rv8g", "packages": ["wagtail"], "path": "advisories/github-reviewed/2026/08/GHSA-jm5p-837g-rv8g/GHSA-jm5p-837g-rv8g.json", "severity": "MODERATE", "status": "changed", "summary": "Wagtail: Improper restriction handling on Page translation API endpoint"}, {"advisory": "https://github.com/advisories/GHSA-x5cx-w6p2-mxf2", "aliases": ["CVE-2026-123819"], "commit": "https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-x5cx-w6p2-mxf2/GHSA-x5cx-w6p2-mxf2.json", "id": "GHSA-x5cx-w6p2-mxf2", "packages": ["wagtail"], "path": "advisories/github-reviewed/2026/08/GHSA-x5cx-w6p2-mxf2/GHSA-x5cx-w6p2-mxf2.json", "severity": "MODERATE", "status": "changed", "summary": "Wagtail: Improper permission handling when copying snippets"}, {"advisory": "https://github.com/advisories/GHSA-vvr2-h2jp-838m", "aliases": ["CVE-2026-77604"], "commit": "https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/11/GHSA-vvr2-h2jp-838m/GHSA-vvr2-h2jp-838m.json", "id": "GHSA-vvr2-h2jp-838m", "packages": ["code-graph-rag"], "path": "advisories/github-reviewed/2026/11/GHSA-vvr2-h2jp-838m/GHSA-vvr2-h2jp-838m.json", "severity": "HIGH", "status": "published", "summary": "Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read"}, {"advisory": "https://github.com/advisories/GHSA-fhp4-pr5j-46m5", "aliases": ["CVE-2026-125107"], "commit": "https://github.com/github/advisory-database/commit/81569964abbda58f1f1d15a2dcbd97e7b0834cb6", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/81569964abbda58f1f1d15a2dcbd97e7b0834cb6/advisories/github-reviewed/2026/06/GHSA-fhp4-pr5j-46m5/GHSA-fhp4-pr5j-46m5.json", "id": "GHSA-fhp4-pr5j-46m5", "packages": ["muhammara"], "path": "advisories/github-reviewed/2026/06/GHSA-fhp4-pr5j-46m5/GHSA-fhp4-pr5j-46m5.json", "severity": "HIGH", "status": "changed", "summary": "Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key"}, {"advisory": "https://github.com/advisories/GHSA-rrh3-cwwj-g5mg", "aliases": ["CVE-2026-43637"], "commit": "https://github.com/github/advisory-database/commit/f953a301e2218bac05e58fd9b70f8a2f3b903eb8", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f953a301e2218bac05e58fd9b70f8a2f3b903eb8/advisories/github-reviewed/2026/07/GHSA-rrh3-cwwj-g5mg/GHSA-rrh3-cwwj-g5mg.json", "id": "GHSA-rrh3-cwwj-g5mg", "packages": ["cornac"], "path": "advisories/github-reviewed/2026/07/GHSA-rrh3-cwwj-g5mg/GHSA-rrh3-cwwj-g5mg.json", "severity": "HIGH", "status": "changed", "summary": "Cornac: Path Traversal via _extract_archive() in download.py"}, {"advisory": "https://github.com/advisories/GHSA-m27g-v28p-f9fx", "aliases": ["CVE-2026-63183"], "commit": "https://github.com/github/advisory-database/commit/c8192f690a9aae85b462b4fde4315042d4e03a32", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/c8192f690a9aae85b462b4fde4315042d4e03a32/advisories/github-reviewed/2026/11/GHSA-m27g-v28p-f9fx/GHSA-m27g-v28p-f9fx.json", "id": "GHSA-m27g-v28p-f9fx", "packages": ["omniauth"], "path": "advisories/github-reviewed/2026/11/GHSA-m27g-v28p-f9fx/GHSA-m27g-v28p-f9fx.json", "severity": "MODERATE", "status": "published", "summary": "OmniAuth: Host Header Injection Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-rr8v-fxxf-c986", "aliases": ["CVE-2026-75598"], "commit": "https://github.com/github/advisory-database/commit/c8192f690a9aae85b462b4fde4315042d4e03a32", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/c8192f690a9aae85b462b4fde4315042d4e03a32/advisories/github-reviewed/2026/11/GHSA-rr8v-fxxf-c986/GHSA-rr8v-fxxf-c986.json", "id": "GHSA-rr8v-fxxf-c986", "packages": ["com.gradleup.shadow:com.gradleup.shadow.gradle.plugin"], "path": "advisories/github-reviewed/2026/11/GHSA-rr8v-fxxf-c986/GHSA-rr8v-fxxf-c986.json", "severity": "HIGH", "status": "published", "summary": "Gradle Shadow: Zip Slip path traversal in ShadowCopyAction \u2014 no independent entry-name sanitization"}, {"advisory": "https://github.com/advisories/GHSA-wchh-mrv2-5h4q", "aliases": ["CVE-2026-86041"], "commit": "https://github.com/github/advisory-database/commit/111b791fd306825d640b789c94e7ac4ee74f09d9", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/111b791fd306825d640b789c94e7ac4ee74f09d9/advisories/github-reviewed/2026/11/GHSA-wchh-mrv2-5h4q/GHSA-wchh-mrv2-5h4q.json", "id": "GHSA-wchh-mrv2-5h4q", "packages": ["github.com/mayswind/ezbookkeeping"], "path": "advisories/github-reviewed/2026/11/GHSA-wchh-mrv2-5h4q/GHSA-wchh-mrv2-5h4q.json", "severity": "MODERATE", "status": "published", "summary": "ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header"}, {"advisory": "https://github.com/advisories/GHSA-f42p-wjw5-97qh", "aliases": ["CVE-2026-102289"], "commit": "https://github.com/github/advisory-database/commit/ab28e9fdeefc6dbd6985d8ace1bd9b62eb4c8c7d", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ab28e9fdeefc6dbd6985d8ace1bd9b62eb4c8c7d/advisories/github-reviewed/2026/11/GHSA-f42p-wjw5-97qh/GHSA-f42p-wjw5-97qh.json", "id": "GHSA-f42p-wjw5-97qh", "packages": ["zizmor"], "path": "advisories/github-reviewed/2026/11/GHSA-f42p-wjw5-97qh/GHSA-f42p-wjw5-97qh.json", "severity": "HIGH", "status": "published", "summary": "zizmor: Debug logging prints available GitHub credentials in cleartext"}, {"advisory": "https://github.com/advisories/GHSA-6j3h-rp73-6rvf", "aliases": ["CVE-2026-102339"], "commit": "https://github.com/github/advisory-database/commit/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3/advisories/github-reviewed/2026/11/GHSA-6j3h-rp73-6rvf/GHSA-6j3h-rp73-6rvf.json", "id": "GHSA-6j3h-rp73-6rvf", "packages": ["github.com/telepresenceio/telepresence/v2"], "path": "advisories/github-reviewed/2026/11/GHSA-6j3h-rp73-6rvf/GHSA-6j3h-rp73-6rvf.json", "severity": "HIGH", "status": "published", "summary": "Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof \u2014 active client sessions hijackable"}, {"advisory": "https://github.com/advisories/GHSA-j8j4-rw65-56r6", "aliases": ["CVE-2026-102340"], "commit": "https://github.com/github/advisory-database/commit/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3/advisories/github-reviewed/2026/11/GHSA-j8j4-rw65-56r6/GHSA-j8j4-rw65-56r6.json", "id": "GHSA-j8j4-rw65-56r6", "packages": ["github.com/telepresenceio/telepresence"], "path": "advisories/github-reviewed/2026/11/GHSA-j8j4-rw65-56r6/GHSA-j8j4-rw65-56r6.json", "severity": "HIGH", "status": "published", "summary": "Telepresence: Traffic Manager gRPC has no auth \u2014 any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets"}, {"advisory": "https://github.com/advisories/GHSA-9vhv-g5hf-m7m7", "aliases": ["CVE-2026-102610"], "commit": "https://github.com/github/advisory-database/commit/654347603de3b8fe2c8c5a49b41c8243f532bfef", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/654347603de3b8fe2c8c5a49b41c8243f532bfef/advisories/github-reviewed/2026/11/GHSA-9vhv-g5hf-m7m7/GHSA-9vhv-g5hf-m7m7.json", "id": "GHSA-9vhv-g5hf-m7m7", "packages": ["fast-agent-mcp"], "path": "advisories/github-reviewed/2026/11/GHSA-9vhv-g5hf-m7m7/GHSA-9vhv-g5hf-m7m7.json", "severity": "MODERATE", "status": "published", "summary": "fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution"}, {"advisory": "https://github.com/advisories/GHSA-g3c2-rjq2-c763", "aliases": ["CVE-2026-102657"], "commit": "https://github.com/github/advisory-database/commit/654347603de3b8fe2c8c5a49b41c8243f532bfef", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/654347603de3b8fe2c8c5a49b41c8243f532bfef/advisories/github-reviewed/2026/11/GHSA-g3c2-rjq2-c763/GHSA-g3c2-rjq2-c763.json", "id": "GHSA-g3c2-rjq2-c763", "packages": ["github.com/esm-dev/esm.sh/web"], "path": "advisories/github-reviewed/2026/11/GHSA-g3c2-rjq2-c763/GHSA-g3c2-rjq2-c763.json", "severity": "HIGH", "status": "published", "summary": "esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal"}, {"advisory": "https://github.com/advisories/GHSA-cp25-j9x5-p5xm", "aliases": ["CVE-2026-103022"], "commit": "https://github.com/github/advisory-database/commit/f2ea90cf42894cc778a695995921b7824e6b37c9", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f2ea90cf42894cc778a695995921b7824e6b37c9/advisories/github-reviewed/2026/11/GHSA-cp25-j9x5-p5xm/GHSA-cp25-j9x5-p5xm.json", "id": "GHSA-cp25-j9x5-p5xm", "packages": ["urwid"], "path": "advisories/github-reviewed/2026/11/GHSA-cp25-j9x5-p5xm/GHSA-cp25-j9x5-p5xm.json", "severity": "MODERATE", "status": "published", "summary": "Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)"}, {"advisory": "https://github.com/advisories/GHSA-xjw9-38cr-6372", "aliases": ["CVE-2026-125112"], "commit": "https://github.com/github/advisory-database/commit/adcc6836465885f35df6365de66c1b8ebb7bd8dd", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/adcc6836465885f35df6365de66c1b8ebb7bd8dd/advisories/github-reviewed/2026/09/GHSA-xjw9-38cr-6372/GHSA-xjw9-38cr-6372.json", "id": "GHSA-xjw9-38cr-6372", "packages": ["djust"], "path": "advisories/github-reviewed/2026/09/GHSA-xjw9-38cr-6372/GHSA-xjw9-38cr-6372.json", "severity": "HIGH", "status": "changed", "summary": "djust: A template binding inherits a context safety grant it never earned (XSS)"}, {"advisory": "https://github.com/advisories/GHSA-vj8v-p5vw-m6v5", "aliases": ["CVE-2026-125113"], "commit": "https://github.com/github/advisory-database/commit/403f74092fc8c07ed25c9eebd116dbcccce3ca39", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/403f74092fc8c07ed25c9eebd116dbcccce3ca39/advisories/github-reviewed/2026/04/GHSA-vj8v-p5vw-m6v5/GHSA-vj8v-p5vw-m6v5.json", "id": "GHSA-vj8v-p5vw-m6v5", "packages": ["xrootd"], "path": "advisories/github-reviewed/2026/04/GHSA-vj8v-p5vw-m6v5/GHSA-vj8v-p5vw-m6v5.json", "severity": "MODERATE", "status": "changed", "summary": "xrootd has path traversal in directory listing that allows access to the parent directory via trailing \"..\" pattern"}, {"advisory": "https://github.com/advisories/GHSA-rm8c-2cv8-jwf6", "aliases": ["CVE-2026-115770"], "commit": "https://github.com/github/advisory-database/commit/403f74092fc8c07ed25c9eebd116dbcccce3ca39", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/403f74092fc8c07ed25c9eebd116dbcccce3ca39/advisories/github-reviewed/2026/11/GHSA-rm8c-2cv8-jwf6/GHSA-rm8c-2cv8-jwf6.json", "id": "GHSA-rm8c-2cv8-jwf6", "packages": ["github.com/pocket-id/pocket-id/backend"], "path": "advisories/github-reviewed/2026/11/GHSA-rm8c-2cv8-jwf6/GHSA-rm8c-2cv8-jwf6.json", "severity": "CRITICAL", "status": "published", "summary": "Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing"}, {"advisory": "https://github.com/advisories/GHSA-4x48-cgf9-q33f", "aliases": ["CVE-2026-125114"], "commit": "https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/04/GHSA-4x48-cgf9-q33f/GHSA-4x48-cgf9-q33f.json", "id": "GHSA-4x48-cgf9-q33f", "packages": ["@novu/api"], "path": "advisories/github-reviewed/2026/04/GHSA-4x48-cgf9-q33f/GHSA-4x48-cgf9-q33f.json", "severity": "HIGH", "status": "changed", "summary": "Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection"}, {"advisory": "https://github.com/advisories/GHSA-vg6v-j97m-h5xq", "aliases": ["CVE-2026-125115"], "commit": "https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/07/GHSA-vg6v-j97m-h5xq/GHSA-vg6v-j97m-h5xq.json", "id": "GHSA-vg6v-j97m-h5xq", "packages": ["@novu/application-generic"], "path": "advisories/github-reviewed/2026/07/GHSA-vg6v-j97m-h5xq/GHSA-vg6v-j97m-h5xq.json", "severity": "MODERATE", "status": "changed", "summary": "@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations \u2014 affects Workflow HTTP request step + Webhook filter condition"}, {"advisory": "https://github.com/advisories/GHSA-85gg-2gfq-q95m", "aliases": ["CVE-2026-87008"], "commit": "https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/11/GHSA-85gg-2gfq-q95m/GHSA-85gg-2gfq-q95m.json", "id": "GHSA-85gg-2gfq-q95m", "packages": ["code-graph-rag"], "path": "advisories/github-reviewed/2026/11/GHSA-85gg-2gfq-q95m/GHSA-85gg-2gfq-q95m.json", "severity": "HIGH", "status": "published", "summary": "Code Graph RAG structural tools follow out-of-root symlinks"}, {"advisory": "https://github.com/advisories/GHSA-f74m-x83r-c4v4", "aliases": ["CVE-2026-94618"], "commit": "https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/11/GHSA-f74m-x83r-c4v4/GHSA-f74m-x83r-c4v4.json", "id": "GHSA-f74m-x83r-c4v4", "packages": ["filegator/filegator"], "path": "advisories/github-reviewed/2026/11/GHSA-f74m-x83r-c4v4/GHSA-f74m-x83r-c4v4.json", "severity": "MODERATE", "status": "published", "summary": "FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive"}, {"advisory": "https://github.com/advisories/GHSA-gj9m-f8ph-pmhr", "aliases": ["CVE-2026-102895"], "commit": "https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/11/GHSA-gj9m-f8ph-pmhr/GHSA-gj9m-f8ph-pmhr.json", "id": "GHSA-gj9m-f8ph-pmhr", "packages": ["gpustack"], "path": "advisories/github-reviewed/2026/11/GHSA-gj9m-f8ph-pmhr/GHSA-gj9m-f8ph-pmhr.json", "severity": "CRITICAL", "status": "published", "summary": "GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin"}, {"advisory": "https://github.com/advisories/GHSA-44r8-3p76-84mw", "aliases": ["CVE-2026-94619"], "commit": "https://github.com/github/advisory-database/commit/1021228fec7b44218a3e9ac6d9a899d13eb5dd26", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/1021228fec7b44218a3e9ac6d9a899d13eb5dd26/advisories/github-reviewed/2026/11/GHSA-44r8-3p76-84mw/GHSA-44r8-3p76-84mw.json", "id": "GHSA-44r8-3p76-84mw", "packages": ["filegator/filegator"], "path": "advisories/github-reviewed/2026/11/GHSA-44r8-3p76-84mw/GHSA-44r8-3p76-84mw.json", "severity": "MODERATE", "status": "published", "summary": "FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files"}, {"advisory": "https://github.com/advisories/GHSA-9qq5-422f-33c2", "aliases": ["CVE-2026-85737"], "commit": "https://github.com/github/advisory-database/commit/b3734c9c566052b56be1a4d31d75f5a5620c6f46", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/b3734c9c566052b56be1a4d31d75f5a5620c6f46/advisories/github-reviewed/2026/11/GHSA-9qq5-422f-33c2/GHSA-9qq5-422f-33c2.json", "id": "GHSA-9qq5-422f-33c2", "packages": ["www.velocidex.com/golang/velociraptor"], "path": "advisories/github-reviewed/2026/11/GHSA-9qq5-422f-33c2/GHSA-9qq5-422f-33c2.json", "severity": "MODERATE", "status": "published", "summary": "Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin"}, {"advisory": "https://github.com/advisories/GHSA-rjr3-43j3-4q8g", "aliases": ["CVE-2026-77596"], "commit": "https://github.com/github/advisory-database/commit/b3734c9c566052b56be1a4d31d75f5a5620c6f46", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/b3734c9c566052b56be1a4d31d75f5a5620c6f46/advisories/github-reviewed/2026/11/GHSA-rjr3-43j3-4q8g/GHSA-rjr3-43j3-4q8g.json", "id": "GHSA-rjr3-43j3-4q8g", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-rjr3-43j3-4q8g/GHSA-rjr3-43j3-4q8g.json", "severity": "CRITICAL", "status": "published", "summary": "Kubeflow Pipelines API server lacks authorization for shared pipeline uploads"}, {"advisory": "https://github.com/advisories/GHSA-h89v-g948-47vp", "aliases": ["CVE-2026-97705"], "commit": "https://github.com/github/advisory-database/commit/be7ccaaa5a50cc26fa0f3d9a09a099f55ed875b3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/be7ccaaa5a50cc26fa0f3d9a09a099f55ed875b3/advisories/github-reviewed/2026/11/GHSA-h89v-g948-47vp/GHSA-h89v-g948-47vp.json", "id": "GHSA-h89v-g948-47vp", "packages": ["moleculer"], "path": "advisories/github-reviewed/2026/11/GHSA-h89v-g948-47vp/GHSA-h89v-g948-47vp.json", "severity": "HIGH", "status": "published", "summary": "Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser"}, {"advisory": "https://github.com/advisories/GHSA-9hq4-hm3j-jmph", "aliases": ["CVE-2026-108262"], "commit": "https://github.com/github/advisory-database/commit/a645cef65b99e828b26daf2d6ada08e377d0fc46", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/a645cef65b99e828b26daf2d6ada08e377d0fc46/advisories/github-reviewed/2026/11/GHSA-9hq4-hm3j-jmph/GHSA-9hq4-hm3j-jmph.json", "id": "GHSA-9hq4-hm3j-jmph", "packages": ["github.com/ddev/ddev"], "path": "advisories/github-reviewed/2026/11/GHSA-9hq4-hm3j-jmph/GHSA-9hq4-hm3j-jmph.json", "severity": "HIGH", "status": "published", "summary": "DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885"}, {"advisory": "https://github.com/advisories/GHSA-x89h-7h96-v88f", "aliases": ["CVE-2026-119298"], "commit": "https://github.com/github/advisory-database/commit/9b78091ed0ea840196837517e432707a26665b76", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/9b78091ed0ea840196837517e432707a26665b76/advisories/github-reviewed/2026/11/GHSA-x89h-7h96-v88f/GHSA-x89h-7h96-v88f.json", "id": "GHSA-x89h-7h96-v88f", "packages": ["github.com/schollz/croc/v11", "github.com/schollz/croc/v10", "github.com/schollz/croc/v9", "github.com/schollz/croc/v8", "github.com/schollz/croc/v6", "github.com/schollz/croc"], "path": "advisories/github-reviewed/2026/11/GHSA-x89h-7h96-v88f/GHSA-x89h-7h96-v88f.json", "severity": "MODERATE", "status": "published", "summary": "croc: Overwrite-confirmation bypass via a crafted \"croc-stdin-\" filename on receive"}, {"advisory": "https://github.com/advisories/GHSA-2xwh-426q-42c5", "aliases": ["CVE-2026-88982"], "commit": "https://github.com/github/advisory-database/commit/75510e9a2edc82ec797fb06fceb055682b7dda1a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/75510e9a2edc82ec797fb06fceb055682b7dda1a/advisories/github-reviewed/2026/11/GHSA-2xwh-426q-42c5/GHSA-2xwh-426q-42c5.json", "id": "GHSA-2xwh-426q-42c5", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-2xwh-426q-42c5/GHSA-2xwh-426q-42c5.json", "severity": "MODERATE", "status": "published", "summary": "Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)"}, {"advisory": "https://github.com/advisories/GHSA-5xjx-9qx6-jcrv", "aliases": ["CVE-2026-88968"], "commit": "https://github.com/github/advisory-database/commit/75510e9a2edc82ec797fb06fceb055682b7dda1a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/75510e9a2edc82ec797fb06fceb055682b7dda1a/advisories/github-reviewed/2026/11/GHSA-5xjx-9qx6-jcrv/GHSA-5xjx-9qx6-jcrv.json", "id": "GHSA-5xjx-9qx6-jcrv", "packages": ["@anthropic-ai/claude-code"], "path": "advisories/github-reviewed/2026/11/GHSA-5xjx-9qx6-jcrv/GHSA-5xjx-9qx6-jcrv.json", "severity": "HIGH", "status": "published", "summary": "Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace"}, {"advisory": "https://github.com/advisories/GHSA-f7vj-6669-qvv4", "aliases": ["CVE-2026-88983"], "commit": "https://github.com/github/advisory-database/commit/75510e9a2edc82ec797fb06fceb055682b7dda1a", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/75510e9a2edc82ec797fb06fceb055682b7dda1a/advisories/github-reviewed/2026/11/GHSA-f7vj-6669-qvv4/GHSA-f7vj-6669-qvv4.json", "id": "GHSA-f7vj-6669-qvv4", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-f7vj-6669-qvv4/GHSA-f7vj-6669-qvv4.json", "severity": "MODERATE", "status": "published", "summary": "Kubeflow Pipelines \u2014 API server fetches a caller-supplied pipelineURL without host validation"}, {"advisory": "https://github.com/advisories/GHSA-ghgh-57qv-h687", "aliases": ["CVE-2026-88984"], "commit": "https://github.com/github/advisory-database/commit/43c949c0bc85a8bbc7c12c7391bbc0f4879c093e", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/43c949c0bc85a8bbc7c12c7391bbc0f4879c093e/advisories/github-reviewed/2026/11/GHSA-ghgh-57qv-h687/GHSA-ghgh-57qv-h687.json", "id": "GHSA-ghgh-57qv-h687", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-ghgh-57qv-h687/GHSA-ghgh-57qv-h687.json", "severity": "HIGH", "status": "published", "summary": "Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines"}, {"advisory": "https://github.com/advisories/GHSA-gcwf-c25f-p9rv", "aliases": ["CVE-2026-77433"], "commit": "https://github.com/github/advisory-database/commit/ef91dcbf209cbe30c5e979992aaf24803187a43a", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ef91dcbf209cbe30c5e979992aaf24803187a43a/advisories/github-reviewed/2026/11/GHSA-gcwf-c25f-p9rv/GHSA-gcwf-c25f-p9rv.json", "id": "GHSA-gcwf-c25f-p9rv", "packages": ["kiwitcms"], "path": "advisories/github-reviewed/2026/11/GHSA-gcwf-c25f-p9rv/GHSA-gcwf-c25f-p9rv.json", "severity": "MODERATE", "status": "published", "summary": "Kiwi TCMS account confirmation open redirect through protocol-relative URLs"}, {"advisory": "https://github.com/advisories/GHSA-g3qx-frcg-j979", "aliases": ["CVE-2026-88986"], "commit": "https://github.com/github/advisory-database/commit/ffd82943a698aa62aed95bcc199eb036dc53c899", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/ffd82943a698aa62aed95bcc199eb036dc53c899/advisories/github-reviewed/2026/11/GHSA-g3qx-frcg-j979/GHSA-g3qx-frcg-j979.json", "id": "GHSA-g3qx-frcg-j979", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-g3qx-frcg-j979/GHSA-g3qx-frcg-j979.json", "severity": "MODERATE", "status": "published", "summary": "Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses"}, {"advisory": "https://github.com/advisories/GHSA-r4mx-2gr2-8277", "aliases": ["CVE-2026-88985"], "commit": "https://github.com/github/advisory-database/commit/ffd82943a698aa62aed95bcc199eb036dc53c899", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/ffd82943a698aa62aed95bcc199eb036dc53c899/advisories/github-reviewed/2026/11/GHSA-r4mx-2gr2-8277/GHSA-r4mx-2gr2-8277.json", "id": "GHSA-r4mx-2gr2-8277", "packages": ["github.com/kubeflow/pipelines"], "path": "advisories/github-reviewed/2026/11/GHSA-r4mx-2gr2-8277/GHSA-r4mx-2gr2-8277.json", "severity": "MODERATE", "status": "published", "summary": "Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server"}], "sourceId": "advisories-reviewed", "text": "On November 9, 2026, GitHub's security advisory list published 45 new advisories, changed 23, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 47895, "fingerprint": "bcf53050c596fae2cafe33522c1642f2a6fdc220ec6cdcf41d282a61e3afd0ef", "url": "https://flarereef.flareforward.com/files/watch/bcf53050c596fae2cafe33522c1642f2a6fdc220ec6cdcf41d282a61e3afd0ef.json"}}, "project": {"projectId": 20, "name": "Security advisories (GitHub reviewed)", "kind": "watch", "keeper": "GitHub", "jurisdiction": "", "markText": "GH", "shape": "", "what": "GitHub's security advisory list", "repoUrl": "https://github.com/github/advisory-database", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "chunk": "day"}, "date": "2026-11-10", "author": {"name": "Flare Reef watcher", "handle": "", "verified": false}}