{"note": {"noteId": 457, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0x79f64a50516cf2ae808af10e782c52eb31e94ee75f52a18139746182645ab0af", "content": "{\"counts\":{\"changed\":20,\"published\":74,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-10\",\"fullList\":{\"bytes\":68919,\"fingerprint\":\"ccb788816f3a14a056719c5c0fe492c2823ef8b5df6db7be10c475195dfe393d\",\"url\":\"https://flarereef.flareforward.com/files/watch/ccb788816f3a14a056719c5c0fe492c2823ef8b5df6db7be10c475195dfe393d.json\"},\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-11T02:05:42Z\",\"rows\":[{\"advisory\":\"https://github.com/advisories/GHSA-358w-w75h-x6rx\",\"aliases\":[\"CVE-2026-119299\"],\"commit\":\"https://github.com/github/advisory-database/commit/2da186578d52e1ad5313480db466ac18ee2718cd\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/2da186578d52e1ad5313480db466ac18ee2718cd/advisories/github-reviewed/2026/11/GHSA-358w-w75h-x6rx/GHSA-358w-w75h-x6rx.json\",\"id\":\"GHSA-358w-w75h-x6rx\",\"packages\":[\"github.com/gopacket/gopacket\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-358w-w75h-x6rx/GHSA-358w-w75h-x6rx.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments\"},{\"advisory\":\"https://github.com/advisories/GHSA-5m6c-38r8-5w76\",\"aliases\":[\"CVE-2026-102943\"],\"commit\":\"https://github.com/github/advisory-database/commit/2da186578d52e1ad5313480db466ac18ee2718cd\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/2da186578d52e1ad5313480db466ac18ee2718cd/advisories/github-reviewed/2026/11/GHSA-5m6c-38r8-5w76/GHSA-5m6c-38r8-5w76.json\",\"id\":\"GHSA-5m6c-38r8-5w76\",\"packages\":[\"github.com/dagu-org/dagu/v2\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-5m6c-38r8-5w76/GHSA-5m6c-38r8-5w76.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Dagu MCP DAG specification read bypasses path containment and workspace isolation\"},{\"advisory\":\"https://github.com/advisories/GHSA-2h4w-29cv-2cmv\",\"aliases\":[\"CVE-2026-113663\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-2h4w-29cv-2cmv/GHSA-2h4w-29cv-2cmv.json\",\"id\":\"GHSA-2h4w-29cv-2cmv\",\"packages\":[\"ag2\",\"autogen\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-2h4w-29cv-2cmv/GHSA-2h4w-29cv-2cmv.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution\"},{\"advisory\":\"https://github.com/advisories/GHSA-2vgq-wchc-25w7\",\"aliases\":[\"CVE-2026-118776\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-2vgq-wchc-25w7/GHSA-2vgq-wchc-25w7.json\",\"id\":\"GHSA-2vgq-wchc-25w7\",\"packages\":[\"node-forge\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-2vgq-wchc-25w7/GHSA-2vgq-wchc-25w7.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption\"},{\"advisory\":\"https://github.com/advisories/GHSA-3hch-x692-6qj3\",\"aliases\":[\"CVE-2026-103002\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-3hch-x692-6qj3/GHSA-3hch-x692-6qj3.json\",\"id\":\"GHSA-3hch-x692-6qj3\",\"packages\":[\"gpustack\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-3hch-x692-6qj3/GHSA-3hch-x692-6qj3.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover\"},{\"advisory\":\"https://github.com/advisories/GHSA-62m9-f875-rqw6\",\"aliases\":[\"CVE-2026-102894\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-62m9-f875-rqw6/GHSA-62m9-f875-rqw6.json\",\"id\":\"GHSA-62m9-f875-rqw6\",\"packages\":[\"gpustack\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-62m9-f875-rqw6/GHSA-62m9-f875-rqw6.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover\"},{\"advisory\":\"https://github.com/advisories/GHSA-65v8-q222-64xx\",\"aliases\":[\"CVE-2026-123370\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-65v8-q222-64xx/GHSA-65v8-q222-64xx.json\",\"id\":\"GHSA-65v8-q222-64xx\",\"packages\":[\"compose-lint\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-65v8-q222-64xx/GHSA-65v8-q222-64xx.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"compose-lint: `fix --apply` can delete a line the user did not select, including a security setting\"},{\"advisory\":\"https://github.com/advisories/GHSA-6f4g-xm8v-pgv6\",\"aliases\":[\"CVE-2026-123369\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"GitHub Actions\",\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json\",\"id\":\"GHSA-6f4g-xm8v-pgv6\",\"packages\":[\"tmatens/compose-lint\",\"compose-lint\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action\"},{\"advisory\":\"https://github.com/advisories/GHSA-6qrw-m8cv-hcxf\",\"aliases\":[\"CVE-2026-119192\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-6qrw-m8cv-hcxf/GHSA-6qrw-m8cv-hcxf.json\",\"id\":\"GHSA-6qrw-m8cv-hcxf\",\"packages\":[\"node-forge\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-6qrw-m8cv-hcxf/GHSA-6qrw-m8cv-hcxf.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding\"},{\"advisory\":\"https://github.com/advisories/GHSA-6wcv-rj3c-mhv3\",\"aliases\":[\"CVE-2026-123368\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"PyPI\",\"GitHub Actions\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-6wcv-rj3c-mhv3/GHSA-6wcv-rj3c-mhv3.json\",\"id\":\"GHSA-6wcv-rj3c-mhv3\",\"packages\":[\"compose-lint\",\"tmatens/compose-lint\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-6wcv-rj3c-mhv3/GHSA-6wcv-rj3c-mhv3.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"compose-lint: .env read through a symlink outside the project can expose the CI job's environment\"},{\"advisory\":\"https://github.com/advisories/GHSA-752m-7p75-49gf\",\"aliases\":[\"CVE-2026-110802\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-752m-7p75-49gf/GHSA-752m-7p75-49gf.json\",\"id\":\"GHSA-752m-7p75-49gf\",\"packages\":[\"altair-static\",\"altair-express-middleware\",\"altair-koa-middleware\",\"altair-fastify-plugin\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-752m-7p75-49gf/GHSA-752m-7p75-49gf.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox\"},{\"advisory\":\"https://github.com/advisories/GHSA-88f4-frh5-gmcr\",\"aliases\":[\"CVE-2026-123371\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"PyPI\",\"GitHub Actions\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-88f4-frh5-gmcr/GHSA-88f4-frh5-gmcr.json\",\"id\":\"GHSA-88f4-frh5-gmcr\",\"packages\":[\"compose-lint\",\"tmatens/compose-lint\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-88f4-frh5-gmcr/GHSA-88f4-frh5-gmcr.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target\"},{\"advisory\":\"https://github.com/advisories/GHSA-8vv3-6qpc-gpw6\",\"aliases\":[\"CVE-2026-107846\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-8vv3-6qpc-gpw6/GHSA-8vv3-6qpc-gpw6.json\",\"id\":\"GHSA-8vv3-6qpc-gpw6\",\"packages\":[\"bitcoinjs-lib\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-8vv3-6qpc-gpw6/GHSA-8vv3-6qpc-gpw6.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list\"},{\"advisory\":\"https://github.com/advisories/GHSA-9wg5-mj3p-v49q\",\"aliases\":[\"CVE-2026-118774\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-9wg5-mj3p-v49q/GHSA-9wg5-mj3p-v49q.json\",\"id\":\"GHSA-9wg5-mj3p-v49q\",\"packages\":[\"node-forge\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-9wg5-mj3p-v49q/GHSA-9wg5-mj3p-v49q.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Forge: Certificate signature verified with the issuer's RSA signature scheme\"},{\"advisory\":\"https://github.com/advisories/GHSA-chp3-j5qr-2vfr\",\"aliases\":[\"CVE-2026-115779\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-chp3-j5qr-2vfr/GHSA-chp3-j5qr-2vfr.json\",\"id\":\"GHSA-chp3-j5qr-2vfr\",\"packages\":[\"@effect/platform\",\"effect\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-chp3-j5qr-2vfr/GHSA-chp3-j5qr-2vfr.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()\"},{\"advisory\":\"https://github.com/advisories/GHSA-ghwv-vrp2-2975\",\"aliases\":[\"CVE-2026-119345\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-ghwv-vrp2-2975/GHSA-ghwv-vrp2-2975.json\",\"id\":\"GHSA-ghwv-vrp2-2975\",\"packages\":[\"github.com/ultravioletrs/cocos\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-ghwv-vrp2-2975/GHSA-ghwv-vrp2-2975.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks\"},{\"advisory\":\"https://github.com/advisories/GHSA-h46v-rmh6-fq4f\",\"aliases\":[\"CVE-2026-119189\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-h46v-rmh6-fq4f/GHSA-h46v-rmh6-fq4f.json\",\"id\":\"GHSA-h46v-rmh6-fq4f\",\"packages\":[\"node-forge\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-h46v-rmh6-fq4f/GHSA-h46v-rmh6-fq4f.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage\"},{\"advisory\":\"https://github.com/advisories/GHSA-jf3h-8jvx-vcrg\",\"aliases\":[\"CVE-2026-123372\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"PyPI\",\"GitHub Actions\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-jf3h-8jvx-vcrg/GHSA-jf3h-8jvx-vcrg.json\",\"id\":\"GHSA-jf3h-8jvx-vcrg\",\"packages\":[\"compose-lint\",\"tmatens/compose-lint\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-jf3h-8jvx-vcrg/GHSA-jf3h-8jvx-vcrg.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings\"},{\"advisory\":\"https://github.com/advisories/GHSA-p623-mxf7-qxjm\",\"aliases\":[\"CVE-2026-123364\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-p623-mxf7-qxjm/GHSA-p623-mxf7-qxjm.json\",\"id\":\"GHSA-p623-mxf7-qxjm\",\"packages\":[\"OctoPrint\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-p623-mxf7-qxjm/GHSA-p623-mxf7-qxjm.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"OctoPrint: Stored XSS via saved connection parameters\"},{\"advisory\":\"https://github.com/advisories/GHSA-rhr8-3pm8-cq29\",\"aliases\":[\"CVE-2026-119191\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-rhr8-3pm8-cq29/GHSA-rhr8-3pm8-cq29.json\",\"id\":\"GHSA-rhr8-3pm8-cq29\",\"packages\":[\"node-forge\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-rhr8-3pm8-cq29/GHSA-rhr8-3pm8-cq29.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer\"},{\"advisory\":\"https://github.com/advisories/GHSA-rm8w-w798-g545\",\"aliases\":[\"CVE-2026-123796\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"PyPI\",\"GitHub Actions\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-rm8w-w798-g545/GHSA-rm8w-w798-g545.json\",\"id\":\"GHSA-rm8w-w798-g545\",\"packages\":[\"compose-lint\",\"tmatens/compose-lint\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-rm8w-w798-g545/GHSA-rm8w-w798-g545.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`\"},{\"advisory\":\"https://github.com/advisories/GHSA-whr6-fgpq-fpv9\",\"aliases\":[\"CVE-2026-123373\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"PyPI\",\"GitHub Actions\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-whr6-fgpq-fpv9/GHSA-whr6-fgpq-fpv9.json\",\"id\":\"GHSA-whr6-fgpq-fpv9\",\"packages\":[\"compose-lint\",\"tmatens/compose-lint\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-whr6-fgpq-fpv9/GHSA-whr6-fgpq-fpv9.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output\"},{\"advisory\":\"https://github.com/advisories/GHSA-xggf-m53x-jc3f\",\"aliases\":[\"CVE-2026-95860\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-xggf-m53x-jc3f/GHSA-xggf-m53x-jc3f.json\",\"id\":\"GHSA-xggf-m53x-jc3f\",\"packages\":[\"node-opcua\",\"node-opcua-address-space\",\"node-opcua-server\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-xggf-m53x-jc3f/GHSA-xggf-m53x-jc3f.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions\"},{\"advisory\":\"https://github.com/advisories/GHSA-xwgp-w3pj-q5h3\",\"aliases\":[\"CVE-2026-118670\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-xwgp-w3pj-q5h3/GHSA-xwgp-w3pj-q5h3.json\",\"id\":\"GHSA-xwgp-w3pj-q5h3\",\"packages\":[\"@ohif/extension-dicom-pdf\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-xwgp-w3pj-q5h3/GHSA-xwgp-w3pj-q5h3.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document\"},{\"advisory\":\"https://github.com/advisories/GHSA-xxrh-5hgg-gj4h\",\"aliases\":[\"CVE-2026-102650\"],\"commit\":\"https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-xxrh-5hgg-gj4h/GHSA-xxrh-5hgg-gj4h.json\",\"id\":\"GHSA-xxrh-5hgg-gj4h\",\"packages\":[\"@nuxt/content\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-xxrh-5hgg-gj4h/GHSA-xxrh-5hgg-gj4h.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API\"},{\"advisory\":\"https://github.com/advisories/GHSA-r7j4-crjv-h467\",\"aliases\":[\"CVE-2026-125121\"],\"commit\":\"https://github.com/github/advisory-database/commit/2377df64ff97bf1c538b37f172175f2d5e0fb040\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/2377df64ff97bf1c538b37f172175f2d5e0fb040/advisories/github-reviewed/2026/11/GHSA-r7j4-crjv-h467/GHSA-r7j4-crjv-h467.json\",\"id\":\"GHSA-r7j4-crjv-h467\",\"packages\":[\"compose-lint\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-r7j4-crjv-h467/GHSA-r7j4-crjv-h467.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output\"},{\"advisory\":\"https://github.com/advisories/GHSA-wvg4-6p58-3gh3\",\"aliases\":[\"CVE-2026-125110\"],\"commit\":\"https://github.com/github/advisory-database/commit/c9e08863cdccfbf11668980c776059347422cfc0\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/c9e08863cdccfbf11668980c776059347422cfc0/advisories/github-reviewed/2026/11/GHSA-wvg4-6p58-3gh3/GHSA-wvg4-6p58-3gh3.json\",\"id\":\"GHSA-wvg4-6p58-3gh3\",\"packages\":[\"rack\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-wvg4-6p58-3gh3/GHSA-wvg4-6p58-3gh3.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch\"},{\"advisory\":\"https://github.com/advisories/GHSA-f9x3-7vq9-cph6\",\"aliases\":[\"CVE-2026-114509\"],\"commit\":\"https://github.com/github/advisory-database/commit/eef5bd230119e52ff7cc071b00265c9df5ed6483\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/eef5bd230119e52ff7cc071b00265c9df5ed6483/advisories/github-reviewed/2026/10/GHSA-f9x3-7vq9-cph6/GHSA-f9x3-7vq9-cph6.json\",\"id\":\"GHSA-f9x3-7vq9-cph6\",\"packages\":[\"laravel/framework\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-f9x3-7vq9-cph6/GHSA-f9x3-7vq9-cph6.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Laravel TokenGuard authentication bypass through non-string API credentials\"},{\"advisory\":\"https://github.com/advisories/GHSA-2j8w-xcrc-x985\",\"aliases\":[\"CVE-2026-125109\"],\"commit\":\"https://github.com/github/advisory-database/commit/ac00fcce9dc12d4f0dae8421bc3cfa261938449e\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/ac00fcce9dc12d4f0dae8421bc3cfa261938449e/advisories/github-reviewed/2026/11/GHSA-2j8w-xcrc-x985/GHSA-2j8w-xcrc-x985.json\",\"id\":\"GHSA-2j8w-xcrc-x985\",\"packages\":[\"rack\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-2j8w-xcrc-x985/GHSA-2j8w-xcrc-x985.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header \u2014 incomplete fix of CVE-2026-34835\"},{\"advisory\":\"https://github.com/advisories/GHSA-wrr5-j383-f7h2\",\"aliases\":[\"CVE-2026-79914\"],\"commit\":\"https://github.com/github/advisory-database/commit/031f9205459cf444236829acb2ac64c68cc44f9a\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/031f9205459cf444236829acb2ac64c68cc44f9a/advisories/github-reviewed/2026/11/GHSA-wrr5-j383-f7h2/GHSA-wrr5-j383-f7h2.json\",\"id\":\"GHSA-wrr5-j383-f7h2\",\"packages\":[\"@nocobase/plugin-action-custom-request\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-wrr5-j383-f7h2/GHSA-wrr5-j383-f7h2.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides\"},{\"advisory\":\"https://github.com/advisories/GHSA-8hm4-r66f-29wr\",\"aliases\":[\"CVE-2026-52841\"],\"commit\":\"https://github.com/github/advisory-database/commit/1bba178598540490bb48615e7ab9760584b3885e\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/1bba178598540490bb48615e7ab9760584b3885e/advisories/github-reviewed/2026/07/GHSA-8hm4-r66f-29wr/GHSA-8hm4-r66f-29wr.json\",\"id\":\"GHSA-8hm4-r66f-29wr\",\"packages\":[\"alextselegidis/easyappointments\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-8hm4-r66f-29wr/GHSA-8hm4-r66f-29wr.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync\"},{\"advisory\":\"https://github.com/advisories/GHSA-996f-334j-67g7\",\"aliases\":[\"CVE-2026-52838\"],\"commit\":\"https://github.com/github/advisory-database/commit/6a2778b73a55d34aabce00236a35167fc1ddfe1f\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/6a2778b73a55d34aabce00236a35167fc1ddfe1f/advisories/github-reviewed/2026/07/GHSA-996f-334j-67g7/GHSA-996f-334j-67g7.json\",\"id\":\"GHSA-996f-334j-67g7\",\"packages\":[\"alextselegidis/easyappointments\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-996f-334j-67g7/GHSA-996f-334j-67g7.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"Easy!Appointments disable_booking_message rendered as raw HTML on public booking page \u2014 Stored XSS\"},{\"advisory\":\"https://github.com/advisories/GHSA-pm5p-7w5h-jm5q\",\"aliases\":[\"CVE-2026-52840\"],\"commit\":\"https://github.com/github/advisory-database/commit/6a2778b73a55d34aabce00236a35167fc1ddfe1f\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/6a2778b73a55d34aabce00236a35167fc1ddfe1f/advisories/github-reviewed/2026/07/GHSA-pm5p-7w5h-jm5q/GHSA-pm5p-7w5h-jm5q.json\",\"id\":\"GHSA-pm5p-7w5h-jm5q\",\"packages\":[\"alextselegidis/easyappointments\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-pm5p-7w5h-jm5q/GHSA-pm5p-7w5h-jm5q.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network\"},{\"advisory\":\"https://github.com/advisories/GHSA-p8x9-v4hv-2w4g\",\"aliases\":[\"CVE-2026-125108\"],\"commit\":\"https://github.com/github/advisory-database/commit/6a2778b73a55d34aabce00236a35167fc1ddfe1f\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/6a2778b73a55d34aabce00236a35167fc1ddfe1f/advisories/github-reviewed/2026/11/GHSA-p8x9-v4hv-2w4g/GHSA-p8x9-v4hv-2w4g.json\",\"id\":\"GHSA-p8x9-v4hv-2w4g\",\"packages\":[\"rack\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-p8x9-v4hv-2w4g/GHSA-p8x9-v4hv-2w4g.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass\"},{\"advisory\":\"https://github.com/advisories/GHSA-fq3v-74gv-27gm\",\"aliases\":[\"CVE-2026-107223\"],\"commit\":\"https://github.com/github/advisory-database/commit/2578fcaa7f4c66d4f4f1b437a4ecf6c8ce063ad7\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/2578fcaa7f4c66d4f4f1b437a4ecf6c8ce063ad7/advisories/github-reviewed/2026/10/GHSA-fq3v-74gv-27gm/GHSA-fq3v-74gv-27gm.json\",\"id\":\"GHSA-fq3v-74gv-27gm\",\"packages\":[\"github.com/xuri/excelize/v2\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-fq3v-74gv-27gm/GHSA-fq3v-74gv-27gm.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process\"},{\"advisory\":\"https://github.com/advisories/GHSA-hgj6-7826-r7m5\",\"aliases\":[\"CVE-2026-54514\"],\"commit\":\"https://github.com/github/advisory-database/commit/2394f9ce1626106d6e7debd69ab1133e98e02171\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/2394f9ce1626106d6e7debd69ab1133e98e02171/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json\",\"id\":\"GHSA-hgj6-7826-r7m5\",\"packages\":[\"com.fasterxml.jackson.core:jackson-databind\",\"tools.jackson.core:jackson-databind\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)\"},{\"advisory\":\"https://github.com/advisories/GHSA-xvh5-g6gv-559v\",\"aliases\":[\"CVE-2026-112902\"],\"commit\":\"https://github.com/github/advisory-database/commit/2394f9ce1626106d6e7debd69ab1133e98e02171\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/2394f9ce1626106d6e7debd69ab1133e98e02171/advisories/github-reviewed/2026/10/GHSA-xvh5-g6gv-559v/GHSA-xvh5-g6gv-559v.json\",\"id\":\"GHSA-xvh5-g6gv-559v\",\"packages\":[\"Pillow\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-xvh5-g6gv-559v/GHSA-xvh5-g6gv-559v.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\" Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags\"},{\"advisory\":\"https://github.com/advisories/GHSA-5v64-555j-wjxm\",\"aliases\":[\"CVE-2026-125111\"],\"commit\":\"https://github.com/github/advisory-database/commit/2394f9ce1626106d6e7debd69ab1133e98e02171\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/2394f9ce1626106d6e7debd69ab1133e98e02171/advisories/github-reviewed/2026/11/GHSA-5v64-555j-wjxm/GHSA-5v64-555j-wjxm.json\",\"id\":\"GHSA-5v64-555j-wjxm\",\"packages\":[\"rack\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-5v64-555j-wjxm/GHSA-5v64-555j-wjxm.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Rack: Multipart parsing allows DoS via unbounded scan buffer growth\"},{\"advisory\":\"https://github.com/advisories/GHSA-7xw9-549r-8jrc\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/7a194920c1404579546d821a5438e36b4ba15760\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/7a194920c1404579546d821a5438e36b4ba15760/advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json\",\"id\":\"GHSA-7xw9-549r-8jrc\",\"packages\":[\"DIRAC\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"DIRAC: SQL injection and lack of access control in PilotManager service\"},{\"advisory\":\"https://github.com/advisories/GHSA-m4m7-4cw8-62j6\",\"aliases\":[\"CVE-2026-61667\"],\"commit\":\"https://github.com/github/advisory-database/commit/7a194920c1404579546d821a5438e36b4ba15760\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/7a194920c1404579546d821a5438e36b4ba15760/advisories/github-reviewed/2026/07/GHSA-m4m7-4cw8-62j6/GHSA-m4m7-4cw8-62j6.json\",\"id\":\"GHSA-m4m7-4cw8-62j6\",\"packages\":[\"DIRAC\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-m4m7-4cw8-62j6/GHSA-m4m7-4cw8-62j6.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval\"}],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 10, 2026, GitHub's security advisory list published 74 new advisories, changed 20, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "https://flarereef.flareforward.com/files/watch/ccb788816f3a14a056719c5c0fe492c2823ef8b5df6db7be10c475195dfe393d.json", "txHash": "0x4297ba28a8ab3aa56250b6c93e51e071dd95db3b54b0887abd38d80be58b7b54", "receiptUrl": "https://flare-explorer.flare.network/tx/0x4297ba28a8ab3aa56250b6c93e51e071dd95db3b54b0887abd38d80be58b7b54", "blockNumber": 74249594, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": [], "parsed": {"counts": {"changed": 20, "published": 74, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-10", "kind": "watch-day", "recordedAt": "2026-11-11T02:05:42Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-358w-w75h-x6rx", "aliases": ["CVE-2026-119299"], "commit": "https://github.com/github/advisory-database/commit/2da186578d52e1ad5313480db466ac18ee2718cd", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2da186578d52e1ad5313480db466ac18ee2718cd/advisories/github-reviewed/2026/11/GHSA-358w-w75h-x6rx/GHSA-358w-w75h-x6rx.json", "id": "GHSA-358w-w75h-x6rx", "packages": ["github.com/gopacket/gopacket"], "path": "advisories/github-reviewed/2026/11/GHSA-358w-w75h-x6rx/GHSA-358w-w75h-x6rx.json", "severity": "MODERATE", "status": "published", "summary": "gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments"}, {"advisory": "https://github.com/advisories/GHSA-5m6c-38r8-5w76", "aliases": ["CVE-2026-102943"], "commit": "https://github.com/github/advisory-database/commit/2da186578d52e1ad5313480db466ac18ee2718cd", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2da186578d52e1ad5313480db466ac18ee2718cd/advisories/github-reviewed/2026/11/GHSA-5m6c-38r8-5w76/GHSA-5m6c-38r8-5w76.json", "id": "GHSA-5m6c-38r8-5w76", "packages": ["github.com/dagu-org/dagu/v2"], "path": "advisories/github-reviewed/2026/11/GHSA-5m6c-38r8-5w76/GHSA-5m6c-38r8-5w76.json", "severity": "MODERATE", "status": "published", "summary": "Dagu MCP DAG specification read bypasses path containment and workspace isolation"}, {"advisory": "https://github.com/advisories/GHSA-2h4w-29cv-2cmv", "aliases": ["CVE-2026-113663"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-2h4w-29cv-2cmv/GHSA-2h4w-29cv-2cmv.json", "id": "GHSA-2h4w-29cv-2cmv", "packages": ["ag2", "autogen"], "path": "advisories/github-reviewed/2026/11/GHSA-2h4w-29cv-2cmv/GHSA-2h4w-29cv-2cmv.json", "severity": "HIGH", "status": "published", "summary": "AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution"}, {"advisory": "https://github.com/advisories/GHSA-2vgq-wchc-25w7", "aliases": ["CVE-2026-118776"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-2vgq-wchc-25w7/GHSA-2vgq-wchc-25w7.json", "id": "GHSA-2vgq-wchc-25w7", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-2vgq-wchc-25w7/GHSA-2vgq-wchc-25w7.json", "severity": "LOW", "status": "published", "summary": "Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption"}, {"advisory": "https://github.com/advisories/GHSA-3hch-x692-6qj3", "aliases": ["CVE-2026-103002"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-3hch-x692-6qj3/GHSA-3hch-x692-6qj3.json", "id": "GHSA-3hch-x692-6qj3", "packages": ["gpustack"], "path": "advisories/github-reviewed/2026/11/GHSA-3hch-x692-6qj3/GHSA-3hch-x692-6qj3.json", "severity": "HIGH", "status": "published", "summary": "GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover"}, {"advisory": "https://github.com/advisories/GHSA-62m9-f875-rqw6", "aliases": ["CVE-2026-102894"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-62m9-f875-rqw6/GHSA-62m9-f875-rqw6.json", "id": "GHSA-62m9-f875-rqw6", "packages": ["gpustack"], "path": "advisories/github-reviewed/2026/11/GHSA-62m9-f875-rqw6/GHSA-62m9-f875-rqw6.json", "severity": "CRITICAL", "status": "published", "summary": "GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover"}, {"advisory": "https://github.com/advisories/GHSA-65v8-q222-64xx", "aliases": ["CVE-2026-123370"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-65v8-q222-64xx/GHSA-65v8-q222-64xx.json", "id": "GHSA-65v8-q222-64xx", "packages": ["compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-65v8-q222-64xx/GHSA-65v8-q222-64xx.json", "severity": "MODERATE", "status": "published", "summary": "compose-lint: `fix --apply` can delete a line the user did not select, including a security setting"}, {"advisory": "https://github.com/advisories/GHSA-6f4g-xm8v-pgv6", "aliases": ["CVE-2026-123369"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["GitHub Actions", "PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json", "id": "GHSA-6f4g-xm8v-pgv6", "packages": ["tmatens/compose-lint", "compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json", "severity": "MODERATE", "status": "published", "summary": "compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action"}, {"advisory": "https://github.com/advisories/GHSA-6qrw-m8cv-hcxf", "aliases": ["CVE-2026-119192"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-6qrw-m8cv-hcxf/GHSA-6qrw-m8cv-hcxf.json", "id": "GHSA-6qrw-m8cv-hcxf", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-6qrw-m8cv-hcxf/GHSA-6qrw-m8cv-hcxf.json", "severity": "HIGH", "status": "published", "summary": "Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding"}, {"advisory": "https://github.com/advisories/GHSA-6wcv-rj3c-mhv3", "aliases": ["CVE-2026-123368"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI", "GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-6wcv-rj3c-mhv3/GHSA-6wcv-rj3c-mhv3.json", "id": "GHSA-6wcv-rj3c-mhv3", "packages": ["compose-lint", "tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-6wcv-rj3c-mhv3/GHSA-6wcv-rj3c-mhv3.json", "severity": "LOW", "status": "published", "summary": "compose-lint: .env read through a symlink outside the project can expose the CI job's environment"}, {"advisory": "https://github.com/advisories/GHSA-752m-7p75-49gf", "aliases": ["CVE-2026-110802"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-752m-7p75-49gf/GHSA-752m-7p75-49gf.json", "id": "GHSA-752m-7p75-49gf", "packages": ["altair-static", "altair-express-middleware", "altair-koa-middleware", "altair-fastify-plugin"], "path": "advisories/github-reviewed/2026/11/GHSA-752m-7p75-49gf/GHSA-752m-7p75-49gf.json", "severity": "MODERATE", "status": "published", "summary": "Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox"}, {"advisory": "https://github.com/advisories/GHSA-88f4-frh5-gmcr", "aliases": ["CVE-2026-123371"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI", "GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-88f4-frh5-gmcr/GHSA-88f4-frh5-gmcr.json", "id": "GHSA-88f4-frh5-gmcr", "packages": ["compose-lint", "tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-88f4-frh5-gmcr/GHSA-88f4-frh5-gmcr.json", "severity": "LOW", "status": "published", "summary": "compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target"}, {"advisory": "https://github.com/advisories/GHSA-8vv3-6qpc-gpw6", "aliases": ["CVE-2026-107846"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-8vv3-6qpc-gpw6/GHSA-8vv3-6qpc-gpw6.json", "id": "GHSA-8vv3-6qpc-gpw6", "packages": ["bitcoinjs-lib"], "path": "advisories/github-reviewed/2026/11/GHSA-8vv3-6qpc-gpw6/GHSA-8vv3-6qpc-gpw6.json", "severity": "CRITICAL", "status": "published", "summary": "bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list"}, {"advisory": "https://github.com/advisories/GHSA-9wg5-mj3p-v49q", "aliases": ["CVE-2026-118774"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-9wg5-mj3p-v49q/GHSA-9wg5-mj3p-v49q.json", "id": "GHSA-9wg5-mj3p-v49q", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-9wg5-mj3p-v49q/GHSA-9wg5-mj3p-v49q.json", "severity": "LOW", "status": "published", "summary": "Forge: Certificate signature verified with the issuer's RSA signature scheme"}, {"advisory": "https://github.com/advisories/GHSA-chp3-j5qr-2vfr", "aliases": ["CVE-2026-115779"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-chp3-j5qr-2vfr/GHSA-chp3-j5qr-2vfr.json", "id": "GHSA-chp3-j5qr-2vfr", "packages": ["@effect/platform", "effect"], "path": "advisories/github-reviewed/2026/11/GHSA-chp3-j5qr-2vfr/GHSA-chp3-j5qr-2vfr.json", "severity": "MODERATE", "status": "published", "summary": "Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()"}, {"advisory": "https://github.com/advisories/GHSA-ghwv-vrp2-2975", "aliases": ["CVE-2026-119345"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-ghwv-vrp2-2975/GHSA-ghwv-vrp2-2975.json", "id": "GHSA-ghwv-vrp2-2975", "packages": ["github.com/ultravioletrs/cocos"], "path": "advisories/github-reviewed/2026/11/GHSA-ghwv-vrp2-2975/GHSA-ghwv-vrp2-2975.json", "severity": "HIGH", "status": "published", "summary": "Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks"}, {"advisory": "https://github.com/advisories/GHSA-h46v-rmh6-fq4f", "aliases": ["CVE-2026-119189"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-h46v-rmh6-fq4f/GHSA-h46v-rmh6-fq4f.json", "id": "GHSA-h46v-rmh6-fq4f", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-h46v-rmh6-fq4f/GHSA-h46v-rmh6-fq4f.json", "severity": "MODERATE", "status": "published", "summary": "Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage"}, {"advisory": "https://github.com/advisories/GHSA-jf3h-8jvx-vcrg", "aliases": ["CVE-2026-123372"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI", "GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-jf3h-8jvx-vcrg/GHSA-jf3h-8jvx-vcrg.json", "id": "GHSA-jf3h-8jvx-vcrg", "packages": ["compose-lint", "tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-jf3h-8jvx-vcrg/GHSA-jf3h-8jvx-vcrg.json", "severity": "LOW", "status": "published", "summary": "compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings"}, {"advisory": "https://github.com/advisories/GHSA-p623-mxf7-qxjm", "aliases": ["CVE-2026-123364"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-p623-mxf7-qxjm/GHSA-p623-mxf7-qxjm.json", "id": "GHSA-p623-mxf7-qxjm", "packages": ["OctoPrint"], "path": "advisories/github-reviewed/2026/11/GHSA-p623-mxf7-qxjm/GHSA-p623-mxf7-qxjm.json", "severity": "LOW", "status": "published", "summary": "OctoPrint: Stored XSS via saved connection parameters"}, {"advisory": "https://github.com/advisories/GHSA-rhr8-3pm8-cq29", "aliases": ["CVE-2026-119191"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-rhr8-3pm8-cq29/GHSA-rhr8-3pm8-cq29.json", "id": "GHSA-rhr8-3pm8-cq29", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-rhr8-3pm8-cq29/GHSA-rhr8-3pm8-cq29.json", "severity": "HIGH", "status": "published", "summary": "Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer"}, {"advisory": "https://github.com/advisories/GHSA-rm8w-w798-g545", "aliases": ["CVE-2026-123796"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI", "GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-rm8w-w798-g545/GHSA-rm8w-w798-g545.json", "id": "GHSA-rm8w-w798-g545", "packages": ["compose-lint", "tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-rm8w-w798-g545/GHSA-rm8w-w798-g545.json", "severity": "LOW", "status": "published", "summary": "compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`"}, {"advisory": "https://github.com/advisories/GHSA-whr6-fgpq-fpv9", "aliases": ["CVE-2026-123373"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI", "GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-whr6-fgpq-fpv9/GHSA-whr6-fgpq-fpv9.json", "id": "GHSA-whr6-fgpq-fpv9", "packages": ["compose-lint", "tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-whr6-fgpq-fpv9/GHSA-whr6-fgpq-fpv9.json", "severity": "LOW", "status": "published", "summary": "compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output"}, {"advisory": "https://github.com/advisories/GHSA-xggf-m53x-jc3f", "aliases": ["CVE-2026-95860"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-xggf-m53x-jc3f/GHSA-xggf-m53x-jc3f.json", "id": "GHSA-xggf-m53x-jc3f", "packages": ["node-opcua", "node-opcua-address-space", "node-opcua-server"], "path": "advisories/github-reviewed/2026/11/GHSA-xggf-m53x-jc3f/GHSA-xggf-m53x-jc3f.json", "severity": "CRITICAL", "status": "published", "summary": "node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions"}, {"advisory": "https://github.com/advisories/GHSA-xwgp-w3pj-q5h3", "aliases": ["CVE-2026-118670"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-xwgp-w3pj-q5h3/GHSA-xwgp-w3pj-q5h3.json", "id": "GHSA-xwgp-w3pj-q5h3", "packages": ["@ohif/extension-dicom-pdf"], "path": "advisories/github-reviewed/2026/11/GHSA-xwgp-w3pj-q5h3/GHSA-xwgp-w3pj-q5h3.json", "severity": "HIGH", "status": "published", "summary": "OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document"}, {"advisory": "https://github.com/advisories/GHSA-xxrh-5hgg-gj4h", "aliases": ["CVE-2026-102650"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-xxrh-5hgg-gj4h/GHSA-xxrh-5hgg-gj4h.json", "id": "GHSA-xxrh-5hgg-gj4h", "packages": ["@nuxt/content"], "path": "advisories/github-reviewed/2026/11/GHSA-xxrh-5hgg-gj4h/GHSA-xxrh-5hgg-gj4h.json", "severity": "HIGH", "status": "published", "summary": "Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API"}, {"advisory": "https://github.com/advisories/GHSA-r7j4-crjv-h467", "aliases": ["CVE-2026-125121"], "commit": "https://github.com/github/advisory-database/commit/2377df64ff97bf1c538b37f172175f2d5e0fb040", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/2377df64ff97bf1c538b37f172175f2d5e0fb040/advisories/github-reviewed/2026/11/GHSA-r7j4-crjv-h467/GHSA-r7j4-crjv-h467.json", "id": "GHSA-r7j4-crjv-h467", "packages": ["compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-r7j4-crjv-h467/GHSA-r7j4-crjv-h467.json", "severity": "MODERATE", "status": "published", "summary": "compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output"}, {"advisory": "https://github.com/advisories/GHSA-wvg4-6p58-3gh3", "aliases": ["CVE-2026-125110"], "commit": "https://github.com/github/advisory-database/commit/c9e08863cdccfbf11668980c776059347422cfc0", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/c9e08863cdccfbf11668980c776059347422cfc0/advisories/github-reviewed/2026/11/GHSA-wvg4-6p58-3gh3/GHSA-wvg4-6p58-3gh3.json", "id": "GHSA-wvg4-6p58-3gh3", "packages": ["rack"], "path": "advisories/github-reviewed/2026/11/GHSA-wvg4-6p58-3gh3/GHSA-wvg4-6p58-3gh3.json", "severity": "MODERATE", "status": "published", "summary": "Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch"}, {"advisory": "https://github.com/advisories/GHSA-f9x3-7vq9-cph6", "aliases": ["CVE-2026-114509"], "commit": "https://github.com/github/advisory-database/commit/eef5bd230119e52ff7cc071b00265c9df5ed6483", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/eef5bd230119e52ff7cc071b00265c9df5ed6483/advisories/github-reviewed/2026/10/GHSA-f9x3-7vq9-cph6/GHSA-f9x3-7vq9-cph6.json", "id": "GHSA-f9x3-7vq9-cph6", "packages": ["laravel/framework"], "path": "advisories/github-reviewed/2026/10/GHSA-f9x3-7vq9-cph6/GHSA-f9x3-7vq9-cph6.json", "severity": "CRITICAL", "status": "changed", "summary": "Laravel TokenGuard authentication bypass through non-string API credentials"}, {"advisory": "https://github.com/advisories/GHSA-2j8w-xcrc-x985", "aliases": ["CVE-2026-125109"], "commit": "https://github.com/github/advisory-database/commit/ac00fcce9dc12d4f0dae8421bc3cfa261938449e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/ac00fcce9dc12d4f0dae8421bc3cfa261938449e/advisories/github-reviewed/2026/11/GHSA-2j8w-xcrc-x985/GHSA-2j8w-xcrc-x985.json", "id": "GHSA-2j8w-xcrc-x985", "packages": ["rack"], "path": "advisories/github-reviewed/2026/11/GHSA-2j8w-xcrc-x985/GHSA-2j8w-xcrc-x985.json", "severity": "MODERATE", "status": "published", "summary": "Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header \u2014 incomplete fix of CVE-2026-34835"}, {"advisory": "https://github.com/advisories/GHSA-wrr5-j383-f7h2", "aliases": ["CVE-2026-79914"], "commit": "https://github.com/github/advisory-database/commit/031f9205459cf444236829acb2ac64c68cc44f9a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/031f9205459cf444236829acb2ac64c68cc44f9a/advisories/github-reviewed/2026/11/GHSA-wrr5-j383-f7h2/GHSA-wrr5-j383-f7h2.json", "id": "GHSA-wrr5-j383-f7h2", "packages": ["@nocobase/plugin-action-custom-request"], "path": "advisories/github-reviewed/2026/11/GHSA-wrr5-j383-f7h2/GHSA-wrr5-j383-f7h2.json", "severity": "MODERATE", "status": "published", "summary": "NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides"}, {"advisory": "https://github.com/advisories/GHSA-8hm4-r66f-29wr", "aliases": ["CVE-2026-52841"], "commit": "https://github.com/github/advisory-database/commit/1bba178598540490bb48615e7ab9760584b3885e", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/1bba178598540490bb48615e7ab9760584b3885e/advisories/github-reviewed/2026/07/GHSA-8hm4-r66f-29wr/GHSA-8hm4-r66f-29wr.json", "id": "GHSA-8hm4-r66f-29wr", "packages": ["alextselegidis/easyappointments"], "path": "advisories/github-reviewed/2026/07/GHSA-8hm4-r66f-29wr/GHSA-8hm4-r66f-29wr.json", "severity": "LOW", "status": "changed", "summary": "Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync"}, {"advisory": "https://github.com/advisories/GHSA-996f-334j-67g7", "aliases": ["CVE-2026-52838"], "commit": "https://github.com/github/advisory-database/commit/6a2778b73a55d34aabce00236a35167fc1ddfe1f", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/6a2778b73a55d34aabce00236a35167fc1ddfe1f/advisories/github-reviewed/2026/07/GHSA-996f-334j-67g7/GHSA-996f-334j-67g7.json", "id": "GHSA-996f-334j-67g7", "packages": ["alextselegidis/easyappointments"], "path": "advisories/github-reviewed/2026/07/GHSA-996f-334j-67g7/GHSA-996f-334j-67g7.json", "severity": "LOW", "status": "changed", "summary": "Easy!Appointments disable_booking_message rendered as raw HTML on public booking page \u2014 Stored XSS"}, {"advisory": "https://github.com/advisories/GHSA-pm5p-7w5h-jm5q", "aliases": ["CVE-2026-52840"], "commit": "https://github.com/github/advisory-database/commit/6a2778b73a55d34aabce00236a35167fc1ddfe1f", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/6a2778b73a55d34aabce00236a35167fc1ddfe1f/advisories/github-reviewed/2026/07/GHSA-pm5p-7w5h-jm5q/GHSA-pm5p-7w5h-jm5q.json", "id": "GHSA-pm5p-7w5h-jm5q", "packages": ["alextselegidis/easyappointments"], "path": "advisories/github-reviewed/2026/07/GHSA-pm5p-7w5h-jm5q/GHSA-pm5p-7w5h-jm5q.json", "severity": "LOW", "status": "changed", "summary": "Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network"}, {"advisory": "https://github.com/advisories/GHSA-p8x9-v4hv-2w4g", "aliases": ["CVE-2026-125108"], "commit": "https://github.com/github/advisory-database/commit/6a2778b73a55d34aabce00236a35167fc1ddfe1f", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/6a2778b73a55d34aabce00236a35167fc1ddfe1f/advisories/github-reviewed/2026/11/GHSA-p8x9-v4hv-2w4g/GHSA-p8x9-v4hv-2w4g.json", "id": "GHSA-p8x9-v4hv-2w4g", "packages": ["rack"], "path": "advisories/github-reviewed/2026/11/GHSA-p8x9-v4hv-2w4g/GHSA-p8x9-v4hv-2w4g.json", "severity": "LOW", "status": "published", "summary": "Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass"}, {"advisory": "https://github.com/advisories/GHSA-fq3v-74gv-27gm", "aliases": ["CVE-2026-107223"], "commit": "https://github.com/github/advisory-database/commit/2578fcaa7f4c66d4f4f1b437a4ecf6c8ce063ad7", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2578fcaa7f4c66d4f4f1b437a4ecf6c8ce063ad7/advisories/github-reviewed/2026/10/GHSA-fq3v-74gv-27gm/GHSA-fq3v-74gv-27gm.json", "id": "GHSA-fq3v-74gv-27gm", "packages": ["github.com/xuri/excelize/v2"], "path": "advisories/github-reviewed/2026/10/GHSA-fq3v-74gv-27gm/GHSA-fq3v-74gv-27gm.json", "severity": "HIGH", "status": "changed", "summary": "Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process"}, {"advisory": "https://github.com/advisories/GHSA-hgj6-7826-r7m5", "aliases": ["CVE-2026-54514"], "commit": "https://github.com/github/advisory-database/commit/2394f9ce1626106d6e7debd69ab1133e98e02171", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/2394f9ce1626106d6e7debd69ab1133e98e02171/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json", "id": "GHSA-hgj6-7826-r7m5", "packages": ["com.fasterxml.jackson.core:jackson-databind", "tools.jackson.core:jackson-databind"], "path": "advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json", "severity": "MODERATE", "status": "changed", "summary": "jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)"}, {"advisory": "https://github.com/advisories/GHSA-xvh5-g6gv-559v", "aliases": ["CVE-2026-112902"], "commit": "https://github.com/github/advisory-database/commit/2394f9ce1626106d6e7debd69ab1133e98e02171", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/2394f9ce1626106d6e7debd69ab1133e98e02171/advisories/github-reviewed/2026/10/GHSA-xvh5-g6gv-559v/GHSA-xvh5-g6gv-559v.json", "id": "GHSA-xvh5-g6gv-559v", "packages": ["Pillow"], "path": "advisories/github-reviewed/2026/10/GHSA-xvh5-g6gv-559v/GHSA-xvh5-g6gv-559v.json", "severity": "HIGH", "status": "changed", "summary": " Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags"}, {"advisory": "https://github.com/advisories/GHSA-5v64-555j-wjxm", "aliases": ["CVE-2026-125111"], "commit": "https://github.com/github/advisory-database/commit/2394f9ce1626106d6e7debd69ab1133e98e02171", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/2394f9ce1626106d6e7debd69ab1133e98e02171/advisories/github-reviewed/2026/11/GHSA-5v64-555j-wjxm/GHSA-5v64-555j-wjxm.json", "id": "GHSA-5v64-555j-wjxm", "packages": ["rack"], "path": "advisories/github-reviewed/2026/11/GHSA-5v64-555j-wjxm/GHSA-5v64-555j-wjxm.json", "severity": "HIGH", "status": "published", "summary": "Rack: Multipart parsing allows DoS via unbounded scan buffer growth"}, {"advisory": "https://github.com/advisories/GHSA-7xw9-549r-8jrc", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/7a194920c1404579546d821a5438e36b4ba15760", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/7a194920c1404579546d821a5438e36b4ba15760/advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json", "id": "GHSA-7xw9-549r-8jrc", "packages": ["DIRAC"], "path": "advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json", "severity": "HIGH", "status": "changed", "summary": "DIRAC: SQL injection and lack of access control in PilotManager service"}, {"advisory": "https://github.com/advisories/GHSA-m4m7-4cw8-62j6", "aliases": ["CVE-2026-61667"], "commit": "https://github.com/github/advisory-database/commit/7a194920c1404579546d821a5438e36b4ba15760", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/7a194920c1404579546d821a5438e36b4ba15760/advisories/github-reviewed/2026/07/GHSA-m4m7-4cw8-62j6/GHSA-m4m7-4cw8-62j6.json", "id": "GHSA-m4m7-4cw8-62j6", "packages": ["DIRAC"], "path": "advisories/github-reviewed/2026/07/GHSA-m4m7-4cw8-62j6/GHSA-m4m7-4cw8-62j6.json", "severity": "CRITICAL", "status": "changed", "summary": "DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval"}, {"advisory": "https://github.com/advisories/GHSA-vg99-gr89-qhw9", "aliases": ["CVE-2026-61668"], "commit": "https://github.com/github/advisory-database/commit/7a194920c1404579546d821a5438e36b4ba15760", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/7a194920c1404579546d821a5438e36b4ba15760/advisories/github-reviewed/2026/07/GHSA-vg99-gr89-qhw9/GHSA-vg99-gr89-qhw9.json", "id": "GHSA-vg99-gr89-qhw9", "packages": ["DIRAC"], "path": "advisories/github-reviewed/2026/07/GHSA-vg99-gr89-qhw9/GHSA-vg99-gr89-qhw9.json", "severity": "HIGH", "status": "changed", "summary": "DIRAC: Pilot code downloaded over unverified HTTPS connection"}, {"advisory": "https://github.com/advisories/GHSA-pcrw-h46h-c93h", "aliases": ["CVE-2026-125120"], "commit": "https://github.com/github/advisory-database/commit/7a194920c1404579546d821a5438e36b4ba15760", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7a194920c1404579546d821a5438e36b4ba15760/advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json", "id": "GHSA-pcrw-h46h-c93h", "packages": ["mongoose"], "path": "advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json", "severity": "CRITICAL", "status": "published", "summary": "Mongoose: sanitizeFilter not applied on countDocuments"}, {"advisory": "https://github.com/advisories/GHSA-9jpv-c7p4-997x", "aliases": ["CVE-2026-45579"], "commit": "https://github.com/github/advisory-database/commit/4dcabe15d1d58317dc03aaa66358d8fd33b0a423", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/4dcabe15d1d58317dc03aaa66358d8fd33b0a423/advisories/github-reviewed/2026/07/GHSA-9jpv-c7p4-997x/GHSA-9jpv-c7p4-997x.json", "id": "GHSA-9jpv-c7p4-997x", "packages": ["DIRAC"], "path": "advisories/github-reviewed/2026/07/GHSA-9jpv-c7p4-997x/GHSA-9jpv-c7p4-997x.json", "severity": "CRITICAL", "status": "changed", "summary": "DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input"}, {"advisory": "https://github.com/advisories/GHSA-w5f2-9q9c-ff4h", "aliases": ["CVE-2026-105192"], "commit": "https://github.com/github/advisory-database/commit/4dcabe15d1d58317dc03aaa66358d8fd33b0a423", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/4dcabe15d1d58317dc03aaa66358d8fd33b0a423/advisories/github-reviewed/2026/10/GHSA-w5f2-9q9c-ff4h/GHSA-w5f2-9q9c-ff4h.json", "id": "GHSA-w5f2-9q9c-ff4h", "packages": ["lmcache"], "path": "advisories/github-reviewed/2026/10/GHSA-w5f2-9q9c-ff4h/GHSA-w5f2-9q9c-ff4h.json", "severity": "CRITICAL", "status": "changed", "summary": "LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport"}, {"advisory": "https://github.com/advisories/GHSA-wwx6-x28x-8259", "aliases": ["CVE-2026-46702"], "commit": "https://github.com/github/advisory-database/commit/9d24ee4e688adb04f683b2009dcffa8361518d08", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/9d24ee4e688adb04f683b2009dcffa8361518d08/advisories/github-reviewed/2026/05/GHSA-wwx6-x28x-8259/GHSA-wwx6-x28x-8259.json", "id": "GHSA-wwx6-x28x-8259", "packages": ["russh"], "path": "advisories/github-reviewed/2026/05/GHSA-wwx6-x28x-8259/GHSA-wwx6-x28x-8259.json", "severity": "HIGH", "status": "changed", "summary": "russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets"}, {"advisory": "https://github.com/advisories/GHSA-m665-v7pm-7grj", "aliases": ["CVE-2026-115905"], "commit": "https://github.com/github/advisory-database/commit/9d24ee4e688adb04f683b2009dcffa8361518d08", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/9d24ee4e688adb04f683b2009dcffa8361518d08/advisories/github-reviewed/2026/10/GHSA-m665-v7pm-7grj/GHSA-m665-v7pm-7grj.json", "id": "GHSA-m665-v7pm-7grj", "packages": ["zip"], "path": "advisories/github-reviewed/2026/10/GHSA-m665-v7pm-7grj/GHSA-m665-v7pm-7grj.json", "severity": "CRITICAL", "status": "changed", "summary": "zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE"}, {"advisory": "https://github.com/advisories/GHSA-gg4r-jv3p-qx3c", "aliases": ["CVE-2026-125119"], "commit": "https://github.com/github/advisory-database/commit/16f530ccf17d2e537440d9be618fc50ef3f9184e", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/16f530ccf17d2e537440d9be618fc50ef3f9184e/advisories/github-reviewed/2026/11/GHSA-gg4r-jv3p-qx3c/GHSA-gg4r-jv3p-qx3c.json", "id": "GHSA-gg4r-jv3p-qx3c", "packages": ["mongoose"], "path": "advisories/github-reviewed/2026/11/GHSA-gg4r-jv3p-qx3c/GHSA-gg4r-jv3p-qx3c.json", "severity": "HIGH", "status": "published", "summary": "Mongoose: Connection-level sanitizeFilter not applied"}, {"advisory": "https://github.com/advisories/GHSA-fm29-4mq3-phg6", "aliases": ["CVE-2026-125337"], "commit": "https://github.com/github/advisory-database/commit/2b27bbc156da72a7a495aa73bf50e18f413eea86", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/2b27bbc156da72a7a495aa73bf50e18f413eea86/advisories/github-reviewed/2026/08/GHSA-fm29-4mq3-phg6/GHSA-fm29-4mq3-phg6.json", "id": "GHSA-fm29-4mq3-phg6", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-fm29-4mq3-phg6/GHSA-fm29-4mq3-phg6.json", "severity": "HIGH", "status": "changed", "summary": "Winter: ImportExportController AJAX handlers bypass granular import/export permission gate"}, {"advisory": "https://github.com/advisories/GHSA-5cwr-5jxg-pcf6", "aliases": ["CVE-2026-125338"], "commit": "https://github.com/github/advisory-database/commit/8eaca8633958dcf9f5468b860112e853d15db342", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/8eaca8633958dcf9f5468b860112e853d15db342/advisories/github-reviewed/2026/08/GHSA-5cwr-5jxg-pcf6/GHSA-5cwr-5jxg-pcf6.json", "id": "GHSA-5cwr-5jxg-pcf6", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-5cwr-5jxg-pcf6/GHSA-5cwr-5jxg-pcf6.json", "severity": "MODERATE", "status": "changed", "summary": "Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles"}, {"advisory": "https://github.com/advisories/GHSA-p2ch-c2c3-4xm5", "aliases": ["CVE-2026-125339"], "commit": "https://github.com/github/advisory-database/commit/8eaca8633958dcf9f5468b860112e853d15db342", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/8eaca8633958dcf9f5468b860112e853d15db342/advisories/github-reviewed/2026/08/GHSA-p2ch-c2c3-4xm5/GHSA-p2ch-c2c3-4xm5.json", "id": "GHSA-p2ch-c2c3-4xm5", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-p2ch-c2c3-4xm5/GHSA-p2ch-c2c3-4xm5.json", "severity": "MODERATE", "status": "changed", "summary": "Winter: CSRF through AJAX handler names reachable as backend page actions"}, {"advisory": "https://github.com/advisories/GHSA-7mpf-4465-7fc2", "aliases": ["CVE-2026-125341"], "commit": "https://github.com/github/advisory-database/commit/16139f31cf479516b4169e8da4197810c7c1f0ef", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/16139f31cf479516b4169e8da4197810c7c1f0ef/advisories/github-reviewed/2026/08/GHSA-7mpf-4465-7fc2/GHSA-7mpf-4465-7fc2.json", "id": "GHSA-7mpf-4465-7fc2", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-7mpf-4465-7fc2/GHSA-7mpf-4465-7fc2.json", "severity": "LOW", "status": "changed", "summary": "Winter: Stored XSS through Backend List widget image columns"}, {"advisory": "https://github.com/advisories/GHSA-hq84-x37p-j6q5", "aliases": ["CVE-2026-125340"], "commit": "https://github.com/github/advisory-database/commit/16139f31cf479516b4169e8da4197810c7c1f0ef", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/16139f31cf479516b4169e8da4197810c7c1f0ef/advisories/github-reviewed/2026/08/GHSA-hq84-x37p-j6q5/GHSA-hq84-x37p-j6q5.json", "id": "GHSA-hq84-x37p-j6q5", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-hq84-x37p-j6q5/GHSA-hq84-x37p-j6q5.json", "severity": "MODERATE", "status": "changed", "summary": "Winter: Reflected XSS through the search query parameter in the backend Table widget"}, {"advisory": "https://github.com/advisories/GHSA-mpmw-f6h6-3g26", "aliases": ["CVE-2026-126061"], "commit": "https://github.com/github/advisory-database/commit/16139f31cf479516b4169e8da4197810c7c1f0ef", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/16139f31cf479516b4169e8da4197810c7c1f0ef/advisories/github-reviewed/2026/08/GHSA-mpmw-f6h6-3g26/GHSA-mpmw-f6h6-3g26.json", "id": "GHSA-mpmw-f6h6-3g26", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-mpmw-f6h6-3g26/GHSA-mpmw-f6h6-3g26.json", "severity": "MODERATE", "status": "changed", "summary": "Winter: My Account preview exposes another backend user's profile by record ID"}, {"advisory": "https://github.com/advisories/GHSA-6972-9mcm-vhwj", "aliases": ["CVE-2026-125118"], "commit": "https://github.com/github/advisory-database/commit/f2525f5841e21f85dfa6f4ed81dadccea36ea91a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/f2525f5841e21f85dfa6f4ed81dadccea36ea91a/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json", "id": "GHSA-6972-9mcm-vhwj", "packages": ["mongoose"], "path": "advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json", "severity": "MODERATE", "status": "published", "summary": "Mongoose: Prototype pollution via Schema.prototype.virtual()"}, {"advisory": "https://github.com/advisories/GHSA-4p39-36wj-23h4", "aliases": ["CVE-2026-126063"], "commit": "https://github.com/github/advisory-database/commit/6e479a4c0cc81ce990a5def8c5dfa4ab4d704753", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/6e479a4c0cc81ce990a5def8c5dfa4ab4d704753/advisories/github-reviewed/2026/11/GHSA-4p39-36wj-23h4/GHSA-4p39-36wj-23h4.json", "id": "GHSA-4p39-36wj-23h4", "packages": ["nokogiri"], "path": "advisories/github-reviewed/2026/11/GHSA-4p39-36wj-23h4/GHSA-4p39-36wj-23h4.json", "severity": "LOW", "status": "published", "summary": "Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer"}, {"advisory": "https://github.com/advisories/GHSA-3w22-6jfg-527w", "aliases": ["CVE-2026-126064"], "commit": "https://github.com/github/advisory-database/commit/64bde5358938239cda0eb3a28eeeba01143630d5", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/64bde5358938239cda0eb3a28eeeba01143630d5/advisories/github-reviewed/2026/11/GHSA-3w22-6jfg-527w/GHSA-3w22-6jfg-527w.json", "id": "GHSA-3w22-6jfg-527w", "packages": ["nokogiri"], "path": "advisories/github-reviewed/2026/11/GHSA-3w22-6jfg-527w/GHSA-3w22-6jfg-527w.json", "severity": "LOW", "status": "published", "summary": "Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value"}, {"advisory": "https://github.com/advisories/GHSA-v995-44v6-5fqm", "aliases": ["CVE-2026-126062"], "commit": "https://github.com/github/advisory-database/commit/64bde5358938239cda0eb3a28eeeba01143630d5", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/64bde5358938239cda0eb3a28eeeba01143630d5/advisories/github-reviewed/2026/11/GHSA-v995-44v6-5fqm/GHSA-v995-44v6-5fqm.json", "id": "GHSA-v995-44v6-5fqm", "packages": ["nokogiri"], "path": "advisories/github-reviewed/2026/11/GHSA-v995-44v6-5fqm/GHSA-v995-44v6-5fqm.json", "severity": "LOW", "status": "published", "summary": "JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host"}, {"advisory": "https://github.com/advisories/GHSA-8332-j7wj-wjw4", "aliases": ["CVE-2026-125117"], "commit": "https://github.com/github/advisory-database/commit/8f116a86d87b548e74d3a3a7c98717acf0e71ece", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/8f116a86d87b548e74d3a3a7c98717acf0e71ece/advisories/github-reviewed/2026/11/GHSA-8332-j7wj-wjw4/GHSA-8332-j7wj-wjw4.json", "id": "GHSA-8332-j7wj-wjw4", "packages": ["mongoose"], "path": "advisories/github-reviewed/2026/11/GHSA-8332-j7wj-wjw4/GHSA-8332-j7wj-wjw4.json", "severity": "HIGH", "status": "published", "summary": "Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state"}, {"advisory": "https://github.com/advisories/GHSA-wr5m-5jph-8m96", "aliases": ["CVE-2026-125116"], "commit": "https://github.com/github/advisory-database/commit/6a7bebcf3498db7fdcf4b37e5a153c4c3d4f8d64", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/6a7bebcf3498db7fdcf4b37e5a153c4c3d4f8d64/advisories/github-reviewed/2026/11/GHSA-wr5m-5jph-8m96/GHSA-wr5m-5jph-8m96.json", "id": "GHSA-wr5m-5jph-8m96", "packages": ["mongoose"], "path": "advisories/github-reviewed/2026/11/GHSA-wr5m-5jph-8m96/GHSA-wr5m-5jph-8m96.json", "severity": "MODERATE", "status": "published", "summary": "Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections"}, {"advisory": "https://github.com/advisories/GHSA-474x-hrwr-fgx4", "aliases": ["CVE-2026-126066"], "commit": "https://github.com/github/advisory-database/commit/7f16e6e8a374a5674859808ddd08b7680c2f3b3f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7f16e6e8a374a5674859808ddd08b7680c2f3b3f/advisories/github-reviewed/2026/11/GHSA-474x-hrwr-fgx4/GHSA-474x-hrwr-fgx4.json", "id": "GHSA-474x-hrwr-fgx4", "packages": ["fast-xml-parser"], "path": "advisories/github-reviewed/2026/11/GHSA-474x-hrwr-fgx4/GHSA-474x-hrwr-fgx4.json", "severity": "LOW", "status": "published", "summary": "fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags"}, {"advisory": "https://github.com/advisories/GHSA-j8rw-jp99-435v", "aliases": ["CVE-2026-125334"], "commit": "https://github.com/github/advisory-database/commit/fc9d9d012f507f04d8546fd5e372490072c80fa1", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/fc9d9d012f507f04d8546fd5e372490072c80fa1/advisories/github-reviewed/2026/11/GHSA-j8rw-jp99-435v/GHSA-j8rw-jp99-435v.json", "id": "GHSA-j8rw-jp99-435v", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-j8rw-jp99-435v/GHSA-j8rw-jp99-435v.json", "severity": "MODERATE", "status": "published", "summary": "Forge: TLS client crash on a handshake record received without a session"}, {"advisory": "https://github.com/advisories/GHSA-6889-vf6x-f3g5", "aliases": ["CVE-2026-125335"], "commit": "https://github.com/github/advisory-database/commit/ab1a6afca6364e36fbf4238b8673e9bbfb77629a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/ab1a6afca6364e36fbf4238b8673e9bbfb77629a/advisories/github-reviewed/2026/11/GHSA-6889-vf6x-f3g5/GHSA-6889-vf6x-f3g5.json", "id": "GHSA-6889-vf6x-f3g5", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-6889-vf6x-f3g5/GHSA-6889-vf6x-f3g5.json", "severity": "LOW", "status": "published", "summary": "Forge: Ed25519 signature verification accepts small-order public keys"}, {"advisory": "https://github.com/advisories/GHSA-6cv4-p8m7-4r25", "aliases": ["CVE-2026-125333"], "commit": "https://github.com/github/advisory-database/commit/ab1a6afca6364e36fbf4238b8673e9bbfb77629a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/ab1a6afca6364e36fbf4238b8673e9bbfb77629a/advisories/github-reviewed/2026/11/GHSA-6cv4-p8m7-4r25/GHSA-6cv4-p8m7-4r25.json", "id": "GHSA-6cv4-p8m7-4r25", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-6cv4-p8m7-4r25/GHSA-6cv4-p8m7-4r25.json", "severity": "MODERATE", "status": "published", "summary": "Forge: ReDoS in forge.http response header and cookie trimming"}, {"advisory": "https://github.com/advisories/GHSA-w4xr-hqv8-ch44", "aliases": ["CVE-2026-125332"], "commit": "https://github.com/github/advisory-database/commit/ab1a6afca6364e36fbf4238b8673e9bbfb77629a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/ab1a6afca6364e36fbf4238b8673e9bbfb77629a/advisories/github-reviewed/2026/11/GHSA-w4xr-hqv8-ch44/GHSA-w4xr-hqv8-ch44.json", "id": "GHSA-w4xr-hqv8-ch44", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-w4xr-hqv8-ch44/GHSA-w4xr-hqv8-ch44.json", "severity": "MODERATE", "status": "published", "summary": "Forge: TLS client crash on an unsupported ServerHello compression method"}, {"advisory": "https://github.com/advisories/GHSA-2586-8ghr-69fj", "aliases": ["CVE-2026-126076"], "commit": "https://github.com/github/advisory-database/commit/7c36b233a1ac24626d0b7533780316105e32f35c", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/7c36b233a1ac24626d0b7533780316105e32f35c/advisories/github-reviewed/2026/11/GHSA-2586-8ghr-69fj/GHSA-2586-8ghr-69fj.json", "id": "GHSA-2586-8ghr-69fj", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-2586-8ghr-69fj/GHSA-2586-8ghr-69fj.json", "severity": "MODERATE", "status": "published", "summary": "Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore"}, {"advisory": "https://github.com/advisories/GHSA-2gff-2mmg-m73p", "aliases": ["CVE-2026-126083"], "commit": "https://github.com/github/advisory-database/commit/7c36b233a1ac24626d0b7533780316105e32f35c", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/7c36b233a1ac24626d0b7533780316105e32f35c/advisories/github-reviewed/2026/11/GHSA-2gff-2mmg-m73p/GHSA-2gff-2mmg-m73p.json", "id": "GHSA-2gff-2mmg-m73p", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-2gff-2mmg-m73p/GHSA-2gff-2mmg-m73p.json", "severity": "HIGH", "status": "published", "summary": "Action Pack: Possible IP spoofing in Action Dispatch RemoteIp"}, {"advisory": "https://github.com/advisories/GHSA-2w9f-fxwj-w2qf", "aliases": ["CVE-2026-126075"], "commit": "https://github.com/github/advisory-database/commit/cb681a043eb3113ab5845cb2bdbc3186bcbc682b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb681a043eb3113ab5845cb2bdbc3186bcbc682b/advisories/github-reviewed/2026/11/GHSA-2w9f-fxwj-w2qf/GHSA-2w9f-fxwj-w2qf.json", "id": "GHSA-2w9f-fxwj-w2qf", "packages": ["activesupport"], "path": "advisories/github-reviewed/2026/11/GHSA-2w9f-fxwj-w2qf/GHSA-2w9f-fxwj-w2qf.json", "severity": "MODERATE", "status": "published", "summary": "Active Support: Possible XSS vulnerability in Active Support MessagePack serializer"}, {"advisory": "https://github.com/advisories/GHSA-4v2w-w6g6-f8f8", "aliases": ["CVE-2026-126071"], "commit": "https://github.com/github/advisory-database/commit/cb681a043eb3113ab5845cb2bdbc3186bcbc682b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb681a043eb3113ab5845cb2bdbc3186bcbc682b/advisories/github-reviewed/2026/11/GHSA-4v2w-w6g6-f8f8/GHSA-4v2w-w6g6-f8f8.json", "id": "GHSA-4v2w-w6g6-f8f8", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-4v2w-w6g6-f8f8/GHSA-4v2w-w6g6-f8f8.json", "severity": "MODERATE", "status": "published", "summary": "Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming"}, {"advisory": "https://github.com/advisories/GHSA-5957-c7qm-m469", "aliases": ["CVE-2026-126068"], "commit": "https://github.com/github/advisory-database/commit/cb681a043eb3113ab5845cb2bdbc3186bcbc682b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb681a043eb3113ab5845cb2bdbc3186bcbc682b/advisories/github-reviewed/2026/11/GHSA-5957-c7qm-m469/GHSA-5957-c7qm-m469.json", "id": "GHSA-5957-c7qm-m469", "packages": ["actionmailbox"], "path": "advisories/github-reviewed/2026/11/GHSA-5957-c7qm-m469/GHSA-5957-c7qm-m469.json", "severity": "LOW", "status": "published", "summary": "Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress"}, {"advisory": "https://github.com/advisories/GHSA-gmj8-hvj3-49mw", "aliases": ["CVE-2026-126067"], "commit": "https://github.com/github/advisory-database/commit/cb681a043eb3113ab5845cb2bdbc3186bcbc682b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb681a043eb3113ab5845cb2bdbc3186bcbc682b/advisories/github-reviewed/2026/11/GHSA-gmj8-hvj3-49mw/GHSA-gmj8-hvj3-49mw.json", "id": "GHSA-gmj8-hvj3-49mw", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-gmj8-hvj3-49mw/GHSA-gmj8-hvj3-49mw.json", "severity": "LOW", "status": "published", "summary": "Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores"}, {"advisory": "https://github.com/advisories/GHSA-r9jg-fmfx-2gv6", "aliases": ["CVE-2026-126073"], "commit": "https://github.com/github/advisory-database/commit/cb681a043eb3113ab5845cb2bdbc3186bcbc682b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb681a043eb3113ab5845cb2bdbc3186bcbc682b/advisories/github-reviewed/2026/11/GHSA-r9jg-fmfx-2gv6/GHSA-r9jg-fmfx-2gv6.json", "id": "GHSA-r9jg-fmfx-2gv6", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-r9jg-fmfx-2gv6/GHSA-r9jg-fmfx-2gv6.json", "severity": "MODERATE", "status": "published", "summary": "Action Pack: Possible cache poisoning in Action Pack content negotiation"}, {"advisory": "https://github.com/advisories/GHSA-p2pm-g2h6-7j5j", "aliases": ["CVE-2026-126074"], "commit": "https://github.com/github/advisory-database/commit/9311d3982ad98c6bbfe7e47db2fd9e20340a3950", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/9311d3982ad98c6bbfe7e47db2fd9e20340a3950/advisories/github-reviewed/2026/11/GHSA-p2pm-g2h6-7j5j/GHSA-p2pm-g2h6-7j5j.json", "id": "GHSA-p2pm-g2h6-7j5j", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-p2pm-g2h6-7j5j/GHSA-p2pm-g2h6-7j5j.json", "severity": "MODERATE", "status": "published", "summary": "Active Storage: Possible DoS vulnerability in Active Storage filename handling"}, {"advisory": "https://github.com/advisories/GHSA-8474-xrp6-wh69", "aliases": ["CVE-2026-126080"], "commit": "https://github.com/github/advisory-database/commit/f7731de3715541ceb5dbd704e64ea21a7ab2544e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/f7731de3715541ceb5dbd704e64ea21a7ab2544e/advisories/github-reviewed/2026/11/GHSA-8474-xrp6-wh69/GHSA-8474-xrp6-wh69.json", "id": "GHSA-8474-xrp6-wh69", "packages": ["activesupport"], "path": "advisories/github-reviewed/2026/11/GHSA-8474-xrp6-wh69/GHSA-8474-xrp6-wh69.json", "severity": "HIGH", "status": "published", "summary": "Active Support: Possible DoS vulnerability in Active Support safe_constantize"}, {"advisory": "https://github.com/advisories/GHSA-hfr4-8rjc-97m2", "aliases": ["CVE-2026-126085"], "commit": "https://github.com/github/advisory-database/commit/f7731de3715541ceb5dbd704e64ea21a7ab2544e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/f7731de3715541ceb5dbd704e64ea21a7ab2544e/advisories/github-reviewed/2026/11/GHSA-hfr4-8rjc-97m2/GHSA-hfr4-8rjc-97m2.json", "id": "GHSA-hfr4-8rjc-97m2", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-hfr4-8rjc-97m2/GHSA-hfr4-8rjc-97m2.json", "severity": "MODERATE", "status": "published", "summary": "Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage"}, {"advisory": "https://github.com/advisories/GHSA-v924-7rp8-4mxh", "aliases": ["CVE-2026-126186"], "commit": "https://github.com/github/advisory-database/commit/f7731de3715541ceb5dbd704e64ea21a7ab2544e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/f7731de3715541ceb5dbd704e64ea21a7ab2544e/advisories/github-reviewed/2026/11/GHSA-v924-7rp8-4mxh/GHSA-v924-7rp8-4mxh.json", "id": "GHSA-v924-7rp8-4mxh", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-v924-7rp8-4mxh/GHSA-v924-7rp8-4mxh.json", "severity": "HIGH", "status": "published", "summary": "Active Storage: Possible arbitrary file read and remote code execution in video previews, analysis and image processing"}, {"advisory": "https://github.com/advisories/GHSA-hr4h-4c45-v4q4", "aliases": ["CVE-2026-125122"], "commit": "https://github.com/github/advisory-database/commit/77aa58c7ee161e8f62b18b3e15ec6d1e3e5c3343", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/77aa58c7ee161e8f62b18b3e15ec6d1e3e5c3343/advisories/github-reviewed/2026/11/GHSA-hr4h-4c45-v4q4/GHSA-hr4h-4c45-v4q4.json", "id": "GHSA-hr4h-4c45-v4q4", "packages": ["compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-hr4h-4c45-v4q4/GHSA-hr4h-4c45-v4q4.json", "severity": "LOW", "status": "published", "summary": "compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout"}, {"advisory": "https://github.com/advisories/GHSA-xcf7-88g6-7xr8", "aliases": ["CVE-2026-125125"], "commit": "https://github.com/github/advisory-database/commit/209394ddea3bc54942497fec4bdeff952d05931e", "ecosystems": ["GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/209394ddea3bc54942497fec4bdeff952d05931e/advisories/github-reviewed/2026/11/GHSA-xcf7-88g6-7xr8/GHSA-xcf7-88g6-7xr8.json", "id": "GHSA-xcf7-88g6-7xr8", "packages": ["tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-xcf7-88g6-7xr8/GHSA-xcf7-88g6-7xr8.json", "severity": "LOW", "status": "published", "summary": "\u00a0compose-lint: Workflow command injection through SARIF-directory errors triggered by pull request symlinks\u00a0"}, {"advisory": "https://github.com/advisories/GHSA-8v59-qmwv-4p6q", "aliases": ["CVE-2026-125123"], "commit": "https://github.com/github/advisory-database/commit/6e2272eece174cc64c159d2b948fce1b2e054144", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/6e2272eece174cc64c159d2b948fce1b2e054144/advisories/github-reviewed/2026/11/GHSA-8v59-qmwv-4p6q/GHSA-8v59-qmwv-4p6q.json", "id": "GHSA-8v59-qmwv-4p6q", "packages": ["compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-8v59-qmwv-4p6q/GHSA-8v59-qmwv-4p6q.json", "severity": "LOW", "status": "published", "summary": "compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages\u00a0"}, {"advisory": "https://github.com/advisories/GHSA-gxg8-5rwf-cg43", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/f8ec22dd382f14b3f0ce1ac11429fe142752059a", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/f8ec22dd382f14b3f0ce1ac11429fe142752059a/advisories/github-reviewed/2026/11/GHSA-gxg8-5rwf-cg43/GHSA-gxg8-5rwf-cg43.json", "id": "GHSA-gxg8-5rwf-cg43", "packages": ["Microsoft.AspNetCore.SignalR.StackExchangeRedis"], "path": "advisories/github-reviewed/2026/11/GHSA-gxg8-5rwf-cg43/GHSA-gxg8-5rwf-cg43.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-49q5-vjx7-5gwr", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/241dce85c2d001b5e29ae8d6c6a963258be8de0d", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/241dce85c2d001b5e29ae8d6c6a963258be8de0d/advisories/github-reviewed/2026/11/GHSA-49q5-vjx7-5gwr/GHSA-49q5-vjx7-5gwr.json", "id": "GHSA-49q5-vjx7-5gwr", "packages": ["Microsoft.AspNetCore.Server.HttpSys"], "path": "advisories/github-reviewed/2026/11/GHSA-49q5-vjx7-5gwr/GHSA-49q5-vjx7-5gwr.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-c827-j3xf-67v6", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/654004458bcb7b834039d01e06e4b55b17b8b097", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/654004458bcb7b834039d01e06e4b55b17b8b097/advisories/github-reviewed/2026/11/GHSA-c827-j3xf-67v6/GHSA-c827-j3xf-67v6.json", "id": "GHSA-c827-j3xf-67v6", "packages": ["Microsoft.AspNetCore.App.Runtime.linux-arm"], "path": "advisories/github-reviewed/2026/11/GHSA-c827-j3xf-67v6/GHSA-c827-j3xf-67v6.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-114156 - ASP.NET Core Security Feature Bypass Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-95x6-7hq8-2c37", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/9cbf3190c1063686a3fad5940b9b9ee7dc5995cc", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/9cbf3190c1063686a3fad5940b9b9ee7dc5995cc/advisories/github-reviewed/2026/11/GHSA-95x6-7hq8-2c37/GHSA-95x6-7hq8-2c37.json", "id": "GHSA-95x6-7hq8-2c37", "packages": ["Microsoft.AspNetCore.App.Runtime.win-arm64"], "path": "advisories/github-reviewed/2026/11/GHSA-95x6-7hq8-2c37/GHSA-95x6-7hq8-2c37.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-hfpm-4fc4-g2wc", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/9cbf3190c1063686a3fad5940b9b9ee7dc5995cc", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/9cbf3190c1063686a3fad5940b9b9ee7dc5995cc/advisories/github-reviewed/2026/11/GHSA-hfpm-4fc4-g2wc/GHSA-hfpm-4fc4-g2wc.json", "id": "GHSA-hfpm-4fc4-g2wc", "packages": ["Aspire.Cli"], "path": "advisories/github-reviewed/2026/11/GHSA-hfpm-4fc4-g2wc/GHSA-hfpm-4fc4-g2wc.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-fgfw-85w4-gx99", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/98f73dd75a92b1405f17f7d9b5733cbd50b83899", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/98f73dd75a92b1405f17f7d9b5733cbd50b83899/advisories/github-reviewed/2026/11/GHSA-fgfw-85w4-gx99/GHSA-fgfw-85w4-gx99.json", "id": "GHSA-fgfw-85w4-gx99", "packages": ["Aspire.Cli"], "path": "advisories/github-reviewed/2026/11/GHSA-fgfw-85w4-gx99/GHSA-fgfw-85w4-gx99.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-xqc2-xf4c-x3h3", "aliases": ["CVE-2026-126187"], "commit": "https://github.com/github/advisory-database/commit/63b06bf89edea693fa33443d9a6359dfd1d3887d", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/63b06bf89edea693fa33443d9a6359dfd1d3887d/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json", "id": "GHSA-xqc2-xf4c-x3h3", "packages": ["react-server-dom-parcel", "react-server-dom-turbopack", "react-server-dom-webpack"], "path": "advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json", "severity": "CRITICAL", "status": "published", "summary": "React: Unauthenticated Remote Code Execution in React Server Components"}, {"advisory": "https://github.com/advisories/GHSA-xhj5-c3g8-pfj8", "aliases": ["CVE-2026-109476"], "commit": "https://github.com/github/advisory-database/commit/7401bd2baf91ec1a0e8bf15386c32a6cb186a928", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/7401bd2baf91ec1a0e8bf15386c32a6cb186a928/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json", "id": "GHSA-xhj5-c3g8-pfj8", "packages": ["Microsoft.AspNetCore.App.Runtime.linux-arm", "Microsoft.AspNetCore.App.Runtime.linux-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "Microsoft.AspNetCore.App.Runtime.linux-x64", "Microsoft.AspNetCore.App.Runtime.osx-arm64", "Microsoft.AspNetCore.App.Runtime.osx-x64", "Microsoft.AspNetCore.App.Runtime.win-arm64", "Microsoft.AspNetCore.App.Runtime.win-x64", "Microsoft.AspNetCore.App.Runtime.win-x86"], "path": "advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-109476 - ASP.NET Core Information Disclosure Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-x33c-w48q-qrgc", "aliases": ["CVE-2026-114149"], "commit": "https://github.com/github/advisory-database/commit/c12fb372d150a1e2d93646929a18146cda8f5a29", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/c12fb372d150a1e2d93646929a18146cda8f5a29/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json", "id": "GHSA-x33c-w48q-qrgc", "packages": ["Microsoft.AspNetCore.App.Runtime.linux-arm", "Microsoft.AspNetCore.App.Runtime.linux-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "Microsoft.AspNetCore.App.Runtime.linux-x64", "Microsoft.AspNetCore.App.Runtime.osx-arm64", "Microsoft.AspNetCore.App.Runtime.osx-x64", "Microsoft.AspNetCore.App.Runtime.win-arm64", "Microsoft.AspNetCore.App.Runtime.win-x64", "Microsoft.AspNetCore.App.Runtime.win-x86", "Microsoft.AspNetCore.WebUtilities"], "path": "advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json", "severity": "HIGH", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-114149 - ASP.NET Core Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-m28h-pj36-4364", "aliases": ["CVE-2026-118749"], "commit": "https://github.com/github/advisory-database/commit/7de9e61011d0d93daf0476155d8141df98aa7819", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/7de9e61011d0d93daf0476155d8141df98aa7819/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json", "id": "GHSA-m28h-pj36-4364", "packages": ["Microsoft.AspNetCore.App.Runtime.linux-arm", "Microsoft.AspNetCore.App.Runtime.linux-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "Microsoft.AspNetCore.App.Runtime.linux-x64", "Microsoft.AspNetCore.App.Runtime.osx-arm64", "Microsoft.AspNetCore.App.Runtime.osx-x64", "Microsoft.AspNetCore.App.Runtime.win-arm64", "Microsoft.AspNetCore.App.Runtime.win-x64", "Microsoft.AspNetCore.App.Runtime.win-x86", "Microsoft.Extensions.Validation"], "path": "advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-118749 - ASP.NET Core Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-vmv3-wvjp-wqpj", "aliases": ["CVE-2026-118747"], "commit": "https://github.com/github/advisory-database/commit/9276e05b9b31b4c33c7249c9e48e21b29b52cd9b", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/9276e05b9b31b4c33c7249c9e48e21b29b52cd9b/advisories/github-reviewed/2026/11/GHSA-vmv3-wvjp-wqpj/GHSA-vmv3-wvjp-wqpj.json", "id": "GHSA-vmv3-wvjp-wqpj", "packages": ["System.Formats.Cbor"], "path": "advisories/github-reviewed/2026/11/GHSA-vmv3-wvjp-wqpj/GHSA-vmv3-wvjp-wqpj.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-118747 - .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-3g4v-f5gv-c7xf", "aliases": ["CVE-2026-109475"], "commit": "https://github.com/github/advisory-database/commit/c528c4a7d1a9b85f54242a979ece46f2e26e24d1", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/c528c4a7d1a9b85f54242a979ece46f2e26e24d1/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json", "id": "GHSA-3g4v-f5gv-c7xf", "packages": ["Microsoft.NETCore.App.Runtime.linux-arm", "Microsoft.NETCore.App.Runtime.linux-arm64", "Microsoft.NETCore.App.Runtime.linux-musl-arm", "Microsoft.NETCore.App.Runtime.linux-musl-arm64", "Microsoft.NETCore.App.Runtime.linux-musl-x64", "Microsoft.NETCore.App.Runtime.linux-x64", "Microsoft.NETCore.App.Runtime.osx-arm64", "Microsoft.NETCore.App.Runtime.osx-x64"], "path": "advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-109475 - .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-cpw3-h88j-9f6x", "aliases": ["CVE-2026-120796"], "commit": "https://github.com/github/advisory-database/commit/c528c4a7d1a9b85f54242a979ece46f2e26e24d1", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/c528c4a7d1a9b85f54242a979ece46f2e26e24d1/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json", "id": "GHSA-cpw3-h88j-9f6x", "packages": ["Microsoft.NETCore.App.Runtime.linux-arm", "Microsoft.NETCore.App.Runtime.linux-arm64", "Microsoft.NETCore.App.Runtime.linux-musl-arm", "Microsoft.NETCore.App.Runtime.linux-musl-arm64", "Microsoft.NETCore.App.Runtime.linux-musl-x64", "Microsoft.NETCore.App.Runtime.linux-x64", "Microsoft.NETCore.App.Runtime.osx-arm64", "Microsoft.NETCore.App.Runtime.osx-x64", "Microsoft.NETCore.App.Runtime.win-arm64", "Microsoft.NETCore.App.Runtime.win-x64", "Microsoft.NETCore.App.Runtime.win-x86", "System.Text.Json"], "path": "advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-f7vh-h5g3-7jrh", "aliases": ["CVE-2026-120006"], "commit": "https://github.com/github/advisory-database/commit/c528c4a7d1a9b85f54242a979ece46f2e26e24d1", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/c528c4a7d1a9b85f54242a979ece46f2e26e24d1/advisories/github-reviewed/2026/11/GHSA-f7vh-h5g3-7jrh/GHSA-f7vh-h5g3-7jrh.json", "id": "GHSA-f7vh-h5g3-7jrh", "packages": ["Aspire.Hosting.AppHost", "Aspire.Hosting"], "path": "advisories/github-reviewed/2026/11/GHSA-f7vh-h5g3-7jrh/GHSA-f7vh-h5g3-7jrh.json", "severity": "HIGH", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-120006 - Aspire Elevation of Privilege Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-6527-9fp8-r4x6", "aliases": ["CVE-2026-118750"], "commit": "https://github.com/github/advisory-database/commit/9672de6eda406b2becc926ca6a39073659fa910d", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/9672de6eda406b2becc926ca6a39073659fa910d/advisories/github-reviewed/2026/11/GHSA-6527-9fp8-r4x6/GHSA-6527-9fp8-r4x6.json", "id": "GHSA-6527-9fp8-r4x6", "packages": ["Microsoft.AspNetCore.WebUtilities"], "path": "advisories/github-reviewed/2026/11/GHSA-6527-9fp8-r4x6/GHSA-6527-9fp8-r4x6.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-118750 - ASP.NET Core Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-xw2x-23jm-j582", "aliases": ["CVE-2026-109481"], "commit": "https://github.com/github/advisory-database/commit/3259e2adc67907723c9a928f5badc5a6fd99cca9", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/3259e2adc67907723c9a928f5badc5a6fd99cca9/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json", "id": "GHSA-xw2x-23jm-j582", "packages": ["Microsoft.AspNetCore.App.Runtime.linux-arm", "Microsoft.AspNetCore.App.Runtime.linux-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "Microsoft.AspNetCore.App.Runtime.linux-x64", "Microsoft.AspNetCore.App.Runtime.osx-arm64", "Microsoft.AspNetCore.App.Runtime.osx-x64", "Microsoft.AspNetCore.App.Runtime.win-arm64", "Microsoft.AspNetCore.App.Runtime.win-x64", "Microsoft.AspNetCore.App.Runtime.win-x86"], "path": "advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-109481 - ASP.NET Core Elevation of Privilege Vulnerability"}], "sourceId": "advisories-reviewed", "text": "On November 10, 2026, GitHub's security advisory list published 74 new advisories, changed 20, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 68919, "fingerprint": "ccb788816f3a14a056719c5c0fe492c2823ef8b5df6db7be10c475195dfe393d", "url": "https://flarereef.flareforward.com/files/watch/ccb788816f3a14a056719c5c0fe492c2823ef8b5df6db7be10c475195dfe393d.json"}}}, "parsed": {"counts": {"changed": 20, "published": 74, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-10", "kind": "watch-day", "recordedAt": "2026-11-11T02:05:42Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-358w-w75h-x6rx", "aliases": ["CVE-2026-119299"], "commit": "https://github.com/github/advisory-database/commit/2da186578d52e1ad5313480db466ac18ee2718cd", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2da186578d52e1ad5313480db466ac18ee2718cd/advisories/github-reviewed/2026/11/GHSA-358w-w75h-x6rx/GHSA-358w-w75h-x6rx.json", "id": "GHSA-358w-w75h-x6rx", "packages": ["github.com/gopacket/gopacket"], "path": "advisories/github-reviewed/2026/11/GHSA-358w-w75h-x6rx/GHSA-358w-w75h-x6rx.json", "severity": "MODERATE", "status": "published", "summary": "gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments"}, {"advisory": "https://github.com/advisories/GHSA-5m6c-38r8-5w76", "aliases": ["CVE-2026-102943"], "commit": "https://github.com/github/advisory-database/commit/2da186578d52e1ad5313480db466ac18ee2718cd", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2da186578d52e1ad5313480db466ac18ee2718cd/advisories/github-reviewed/2026/11/GHSA-5m6c-38r8-5w76/GHSA-5m6c-38r8-5w76.json", "id": "GHSA-5m6c-38r8-5w76", "packages": ["github.com/dagu-org/dagu/v2"], "path": "advisories/github-reviewed/2026/11/GHSA-5m6c-38r8-5w76/GHSA-5m6c-38r8-5w76.json", "severity": "MODERATE", "status": "published", "summary": "Dagu MCP DAG specification read bypasses path containment and workspace isolation"}, {"advisory": "https://github.com/advisories/GHSA-2h4w-29cv-2cmv", "aliases": ["CVE-2026-113663"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-2h4w-29cv-2cmv/GHSA-2h4w-29cv-2cmv.json", "id": "GHSA-2h4w-29cv-2cmv", "packages": ["ag2", "autogen"], "path": "advisories/github-reviewed/2026/11/GHSA-2h4w-29cv-2cmv/GHSA-2h4w-29cv-2cmv.json", "severity": "HIGH", "status": "published", "summary": "AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution"}, {"advisory": "https://github.com/advisories/GHSA-2vgq-wchc-25w7", "aliases": ["CVE-2026-118776"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-2vgq-wchc-25w7/GHSA-2vgq-wchc-25w7.json", "id": "GHSA-2vgq-wchc-25w7", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-2vgq-wchc-25w7/GHSA-2vgq-wchc-25w7.json", "severity": "LOW", "status": "published", "summary": "Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption"}, {"advisory": "https://github.com/advisories/GHSA-3hch-x692-6qj3", "aliases": ["CVE-2026-103002"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-3hch-x692-6qj3/GHSA-3hch-x692-6qj3.json", "id": "GHSA-3hch-x692-6qj3", "packages": ["gpustack"], "path": "advisories/github-reviewed/2026/11/GHSA-3hch-x692-6qj3/GHSA-3hch-x692-6qj3.json", "severity": "HIGH", "status": "published", "summary": "GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover"}, {"advisory": "https://github.com/advisories/GHSA-62m9-f875-rqw6", "aliases": ["CVE-2026-102894"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-62m9-f875-rqw6/GHSA-62m9-f875-rqw6.json", "id": "GHSA-62m9-f875-rqw6", "packages": ["gpustack"], "path": "advisories/github-reviewed/2026/11/GHSA-62m9-f875-rqw6/GHSA-62m9-f875-rqw6.json", "severity": "CRITICAL", "status": "published", "summary": "GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover"}, {"advisory": "https://github.com/advisories/GHSA-65v8-q222-64xx", "aliases": ["CVE-2026-123370"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-65v8-q222-64xx/GHSA-65v8-q222-64xx.json", "id": "GHSA-65v8-q222-64xx", "packages": ["compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-65v8-q222-64xx/GHSA-65v8-q222-64xx.json", "severity": "MODERATE", "status": "published", "summary": "compose-lint: `fix --apply` can delete a line the user did not select, including a security setting"}, {"advisory": "https://github.com/advisories/GHSA-6f4g-xm8v-pgv6", "aliases": ["CVE-2026-123369"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["GitHub Actions", "PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json", "id": "GHSA-6f4g-xm8v-pgv6", "packages": ["tmatens/compose-lint", "compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json", "severity": "MODERATE", "status": "published", "summary": "compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action"}, {"advisory": "https://github.com/advisories/GHSA-6qrw-m8cv-hcxf", "aliases": ["CVE-2026-119192"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-6qrw-m8cv-hcxf/GHSA-6qrw-m8cv-hcxf.json", "id": "GHSA-6qrw-m8cv-hcxf", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-6qrw-m8cv-hcxf/GHSA-6qrw-m8cv-hcxf.json", "severity": "HIGH", "status": "published", "summary": "Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding"}, {"advisory": "https://github.com/advisories/GHSA-6wcv-rj3c-mhv3", "aliases": ["CVE-2026-123368"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI", "GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-6wcv-rj3c-mhv3/GHSA-6wcv-rj3c-mhv3.json", "id": "GHSA-6wcv-rj3c-mhv3", "packages": ["compose-lint", "tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-6wcv-rj3c-mhv3/GHSA-6wcv-rj3c-mhv3.json", "severity": "LOW", "status": "published", "summary": "compose-lint: .env read through a symlink outside the project can expose the CI job's environment"}, {"advisory": "https://github.com/advisories/GHSA-752m-7p75-49gf", "aliases": ["CVE-2026-110802"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-752m-7p75-49gf/GHSA-752m-7p75-49gf.json", "id": "GHSA-752m-7p75-49gf", "packages": ["altair-static", "altair-express-middleware", "altair-koa-middleware", "altair-fastify-plugin"], "path": "advisories/github-reviewed/2026/11/GHSA-752m-7p75-49gf/GHSA-752m-7p75-49gf.json", "severity": "MODERATE", "status": "published", "summary": "Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox"}, {"advisory": "https://github.com/advisories/GHSA-88f4-frh5-gmcr", "aliases": ["CVE-2026-123371"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI", "GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-88f4-frh5-gmcr/GHSA-88f4-frh5-gmcr.json", "id": "GHSA-88f4-frh5-gmcr", "packages": ["compose-lint", "tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-88f4-frh5-gmcr/GHSA-88f4-frh5-gmcr.json", "severity": "LOW", "status": "published", "summary": "compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target"}, {"advisory": "https://github.com/advisories/GHSA-8vv3-6qpc-gpw6", "aliases": ["CVE-2026-107846"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-8vv3-6qpc-gpw6/GHSA-8vv3-6qpc-gpw6.json", "id": "GHSA-8vv3-6qpc-gpw6", "packages": ["bitcoinjs-lib"], "path": "advisories/github-reviewed/2026/11/GHSA-8vv3-6qpc-gpw6/GHSA-8vv3-6qpc-gpw6.json", "severity": "CRITICAL", "status": "published", "summary": "bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list"}, {"advisory": "https://github.com/advisories/GHSA-9wg5-mj3p-v49q", "aliases": ["CVE-2026-118774"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-9wg5-mj3p-v49q/GHSA-9wg5-mj3p-v49q.json", "id": "GHSA-9wg5-mj3p-v49q", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-9wg5-mj3p-v49q/GHSA-9wg5-mj3p-v49q.json", "severity": "LOW", "status": "published", "summary": "Forge: Certificate signature verified with the issuer's RSA signature scheme"}, {"advisory": "https://github.com/advisories/GHSA-chp3-j5qr-2vfr", "aliases": ["CVE-2026-115779"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-chp3-j5qr-2vfr/GHSA-chp3-j5qr-2vfr.json", "id": "GHSA-chp3-j5qr-2vfr", "packages": ["@effect/platform", "effect"], "path": "advisories/github-reviewed/2026/11/GHSA-chp3-j5qr-2vfr/GHSA-chp3-j5qr-2vfr.json", "severity": "MODERATE", "status": "published", "summary": "Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()"}, {"advisory": "https://github.com/advisories/GHSA-ghwv-vrp2-2975", "aliases": ["CVE-2026-119345"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-ghwv-vrp2-2975/GHSA-ghwv-vrp2-2975.json", "id": "GHSA-ghwv-vrp2-2975", "packages": ["github.com/ultravioletrs/cocos"], "path": "advisories/github-reviewed/2026/11/GHSA-ghwv-vrp2-2975/GHSA-ghwv-vrp2-2975.json", "severity": "HIGH", "status": "published", "summary": "Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks"}, {"advisory": "https://github.com/advisories/GHSA-h46v-rmh6-fq4f", "aliases": ["CVE-2026-119189"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-h46v-rmh6-fq4f/GHSA-h46v-rmh6-fq4f.json", "id": "GHSA-h46v-rmh6-fq4f", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-h46v-rmh6-fq4f/GHSA-h46v-rmh6-fq4f.json", "severity": "MODERATE", "status": "published", "summary": "Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage"}, {"advisory": "https://github.com/advisories/GHSA-jf3h-8jvx-vcrg", "aliases": ["CVE-2026-123372"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI", "GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-jf3h-8jvx-vcrg/GHSA-jf3h-8jvx-vcrg.json", "id": "GHSA-jf3h-8jvx-vcrg", "packages": ["compose-lint", "tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-jf3h-8jvx-vcrg/GHSA-jf3h-8jvx-vcrg.json", "severity": "LOW", "status": "published", "summary": "compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings"}, {"advisory": "https://github.com/advisories/GHSA-p623-mxf7-qxjm", "aliases": ["CVE-2026-123364"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-p623-mxf7-qxjm/GHSA-p623-mxf7-qxjm.json", "id": "GHSA-p623-mxf7-qxjm", "packages": ["OctoPrint"], "path": "advisories/github-reviewed/2026/11/GHSA-p623-mxf7-qxjm/GHSA-p623-mxf7-qxjm.json", "severity": "LOW", "status": "published", "summary": "OctoPrint: Stored XSS via saved connection parameters"}, {"advisory": "https://github.com/advisories/GHSA-rhr8-3pm8-cq29", "aliases": ["CVE-2026-119191"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-rhr8-3pm8-cq29/GHSA-rhr8-3pm8-cq29.json", "id": "GHSA-rhr8-3pm8-cq29", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-rhr8-3pm8-cq29/GHSA-rhr8-3pm8-cq29.json", "severity": "HIGH", "status": "published", "summary": "Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer"}, {"advisory": "https://github.com/advisories/GHSA-rm8w-w798-g545", "aliases": ["CVE-2026-123796"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI", "GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-rm8w-w798-g545/GHSA-rm8w-w798-g545.json", "id": "GHSA-rm8w-w798-g545", "packages": ["compose-lint", "tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-rm8w-w798-g545/GHSA-rm8w-w798-g545.json", "severity": "LOW", "status": "published", "summary": "compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`"}, {"advisory": "https://github.com/advisories/GHSA-whr6-fgpq-fpv9", "aliases": ["CVE-2026-123373"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["PyPI", "GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-whr6-fgpq-fpv9/GHSA-whr6-fgpq-fpv9.json", "id": "GHSA-whr6-fgpq-fpv9", "packages": ["compose-lint", "tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-whr6-fgpq-fpv9/GHSA-whr6-fgpq-fpv9.json", "severity": "LOW", "status": "published", "summary": "compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output"}, {"advisory": "https://github.com/advisories/GHSA-xggf-m53x-jc3f", "aliases": ["CVE-2026-95860"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-xggf-m53x-jc3f/GHSA-xggf-m53x-jc3f.json", "id": "GHSA-xggf-m53x-jc3f", "packages": ["node-opcua", "node-opcua-address-space", "node-opcua-server"], "path": "advisories/github-reviewed/2026/11/GHSA-xggf-m53x-jc3f/GHSA-xggf-m53x-jc3f.json", "severity": "CRITICAL", "status": "published", "summary": "node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions"}, {"advisory": "https://github.com/advisories/GHSA-xwgp-w3pj-q5h3", "aliases": ["CVE-2026-118670"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-xwgp-w3pj-q5h3/GHSA-xwgp-w3pj-q5h3.json", "id": "GHSA-xwgp-w3pj-q5h3", "packages": ["@ohif/extension-dicom-pdf"], "path": "advisories/github-reviewed/2026/11/GHSA-xwgp-w3pj-q5h3/GHSA-xwgp-w3pj-q5h3.json", "severity": "HIGH", "status": "published", "summary": "OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document"}, {"advisory": "https://github.com/advisories/GHSA-xxrh-5hgg-gj4h", "aliases": ["CVE-2026-102650"], "commit": "https://github.com/github/advisory-database/commit/3164a5cac5bfb6c213036b8a7652538472d13b7b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3164a5cac5bfb6c213036b8a7652538472d13b7b/advisories/github-reviewed/2026/11/GHSA-xxrh-5hgg-gj4h/GHSA-xxrh-5hgg-gj4h.json", "id": "GHSA-xxrh-5hgg-gj4h", "packages": ["@nuxt/content"], "path": "advisories/github-reviewed/2026/11/GHSA-xxrh-5hgg-gj4h/GHSA-xxrh-5hgg-gj4h.json", "severity": "HIGH", "status": "published", "summary": "Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API"}, {"advisory": "https://github.com/advisories/GHSA-r7j4-crjv-h467", "aliases": ["CVE-2026-125121"], "commit": "https://github.com/github/advisory-database/commit/2377df64ff97bf1c538b37f172175f2d5e0fb040", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/2377df64ff97bf1c538b37f172175f2d5e0fb040/advisories/github-reviewed/2026/11/GHSA-r7j4-crjv-h467/GHSA-r7j4-crjv-h467.json", "id": "GHSA-r7j4-crjv-h467", "packages": ["compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-r7j4-crjv-h467/GHSA-r7j4-crjv-h467.json", "severity": "MODERATE", "status": "published", "summary": "compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output"}, {"advisory": "https://github.com/advisories/GHSA-wvg4-6p58-3gh3", "aliases": ["CVE-2026-125110"], "commit": "https://github.com/github/advisory-database/commit/c9e08863cdccfbf11668980c776059347422cfc0", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/c9e08863cdccfbf11668980c776059347422cfc0/advisories/github-reviewed/2026/11/GHSA-wvg4-6p58-3gh3/GHSA-wvg4-6p58-3gh3.json", "id": "GHSA-wvg4-6p58-3gh3", "packages": ["rack"], "path": "advisories/github-reviewed/2026/11/GHSA-wvg4-6p58-3gh3/GHSA-wvg4-6p58-3gh3.json", "severity": "MODERATE", "status": "published", "summary": "Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch"}, {"advisory": "https://github.com/advisories/GHSA-f9x3-7vq9-cph6", "aliases": ["CVE-2026-114509"], "commit": "https://github.com/github/advisory-database/commit/eef5bd230119e52ff7cc071b00265c9df5ed6483", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/eef5bd230119e52ff7cc071b00265c9df5ed6483/advisories/github-reviewed/2026/10/GHSA-f9x3-7vq9-cph6/GHSA-f9x3-7vq9-cph6.json", "id": "GHSA-f9x3-7vq9-cph6", "packages": ["laravel/framework"], "path": "advisories/github-reviewed/2026/10/GHSA-f9x3-7vq9-cph6/GHSA-f9x3-7vq9-cph6.json", "severity": "CRITICAL", "status": "changed", "summary": "Laravel TokenGuard authentication bypass through non-string API credentials"}, {"advisory": "https://github.com/advisories/GHSA-2j8w-xcrc-x985", "aliases": ["CVE-2026-125109"], "commit": "https://github.com/github/advisory-database/commit/ac00fcce9dc12d4f0dae8421bc3cfa261938449e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/ac00fcce9dc12d4f0dae8421bc3cfa261938449e/advisories/github-reviewed/2026/11/GHSA-2j8w-xcrc-x985/GHSA-2j8w-xcrc-x985.json", "id": "GHSA-2j8w-xcrc-x985", "packages": ["rack"], "path": "advisories/github-reviewed/2026/11/GHSA-2j8w-xcrc-x985/GHSA-2j8w-xcrc-x985.json", "severity": "MODERATE", "status": "published", "summary": "Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header \u2014 incomplete fix of CVE-2026-34835"}, {"advisory": "https://github.com/advisories/GHSA-wrr5-j383-f7h2", "aliases": ["CVE-2026-79914"], "commit": "https://github.com/github/advisory-database/commit/031f9205459cf444236829acb2ac64c68cc44f9a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/031f9205459cf444236829acb2ac64c68cc44f9a/advisories/github-reviewed/2026/11/GHSA-wrr5-j383-f7h2/GHSA-wrr5-j383-f7h2.json", "id": "GHSA-wrr5-j383-f7h2", "packages": ["@nocobase/plugin-action-custom-request"], "path": "advisories/github-reviewed/2026/11/GHSA-wrr5-j383-f7h2/GHSA-wrr5-j383-f7h2.json", "severity": "MODERATE", "status": "published", "summary": "NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides"}, {"advisory": "https://github.com/advisories/GHSA-8hm4-r66f-29wr", "aliases": ["CVE-2026-52841"], "commit": "https://github.com/github/advisory-database/commit/1bba178598540490bb48615e7ab9760584b3885e", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/1bba178598540490bb48615e7ab9760584b3885e/advisories/github-reviewed/2026/07/GHSA-8hm4-r66f-29wr/GHSA-8hm4-r66f-29wr.json", "id": "GHSA-8hm4-r66f-29wr", "packages": ["alextselegidis/easyappointments"], "path": "advisories/github-reviewed/2026/07/GHSA-8hm4-r66f-29wr/GHSA-8hm4-r66f-29wr.json", "severity": "LOW", "status": "changed", "summary": "Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync"}, {"advisory": "https://github.com/advisories/GHSA-996f-334j-67g7", "aliases": ["CVE-2026-52838"], "commit": "https://github.com/github/advisory-database/commit/6a2778b73a55d34aabce00236a35167fc1ddfe1f", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/6a2778b73a55d34aabce00236a35167fc1ddfe1f/advisories/github-reviewed/2026/07/GHSA-996f-334j-67g7/GHSA-996f-334j-67g7.json", "id": "GHSA-996f-334j-67g7", "packages": ["alextselegidis/easyappointments"], "path": "advisories/github-reviewed/2026/07/GHSA-996f-334j-67g7/GHSA-996f-334j-67g7.json", "severity": "LOW", "status": "changed", "summary": "Easy!Appointments disable_booking_message rendered as raw HTML on public booking page \u2014 Stored XSS"}, {"advisory": "https://github.com/advisories/GHSA-pm5p-7w5h-jm5q", "aliases": ["CVE-2026-52840"], "commit": "https://github.com/github/advisory-database/commit/6a2778b73a55d34aabce00236a35167fc1ddfe1f", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/6a2778b73a55d34aabce00236a35167fc1ddfe1f/advisories/github-reviewed/2026/07/GHSA-pm5p-7w5h-jm5q/GHSA-pm5p-7w5h-jm5q.json", "id": "GHSA-pm5p-7w5h-jm5q", "packages": ["alextselegidis/easyappointments"], "path": "advisories/github-reviewed/2026/07/GHSA-pm5p-7w5h-jm5q/GHSA-pm5p-7w5h-jm5q.json", "severity": "LOW", "status": "changed", "summary": "Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network"}, {"advisory": "https://github.com/advisories/GHSA-p8x9-v4hv-2w4g", "aliases": ["CVE-2026-125108"], "commit": "https://github.com/github/advisory-database/commit/6a2778b73a55d34aabce00236a35167fc1ddfe1f", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/6a2778b73a55d34aabce00236a35167fc1ddfe1f/advisories/github-reviewed/2026/11/GHSA-p8x9-v4hv-2w4g/GHSA-p8x9-v4hv-2w4g.json", "id": "GHSA-p8x9-v4hv-2w4g", "packages": ["rack"], "path": "advisories/github-reviewed/2026/11/GHSA-p8x9-v4hv-2w4g/GHSA-p8x9-v4hv-2w4g.json", "severity": "LOW", "status": "published", "summary": "Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass"}, {"advisory": "https://github.com/advisories/GHSA-fq3v-74gv-27gm", "aliases": ["CVE-2026-107223"], "commit": "https://github.com/github/advisory-database/commit/2578fcaa7f4c66d4f4f1b437a4ecf6c8ce063ad7", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2578fcaa7f4c66d4f4f1b437a4ecf6c8ce063ad7/advisories/github-reviewed/2026/10/GHSA-fq3v-74gv-27gm/GHSA-fq3v-74gv-27gm.json", "id": "GHSA-fq3v-74gv-27gm", "packages": ["github.com/xuri/excelize/v2"], "path": "advisories/github-reviewed/2026/10/GHSA-fq3v-74gv-27gm/GHSA-fq3v-74gv-27gm.json", "severity": "HIGH", "status": "changed", "summary": "Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process"}, {"advisory": "https://github.com/advisories/GHSA-hgj6-7826-r7m5", "aliases": ["CVE-2026-54514"], "commit": "https://github.com/github/advisory-database/commit/2394f9ce1626106d6e7debd69ab1133e98e02171", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/2394f9ce1626106d6e7debd69ab1133e98e02171/advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json", "id": "GHSA-hgj6-7826-r7m5", "packages": ["com.fasterxml.jackson.core:jackson-databind", "tools.jackson.core:jackson-databind"], "path": "advisories/github-reviewed/2026/06/GHSA-hgj6-7826-r7m5/GHSA-hgj6-7826-r7m5.json", "severity": "MODERATE", "status": "changed", "summary": "jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)"}, {"advisory": "https://github.com/advisories/GHSA-xvh5-g6gv-559v", "aliases": ["CVE-2026-112902"], "commit": "https://github.com/github/advisory-database/commit/2394f9ce1626106d6e7debd69ab1133e98e02171", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/2394f9ce1626106d6e7debd69ab1133e98e02171/advisories/github-reviewed/2026/10/GHSA-xvh5-g6gv-559v/GHSA-xvh5-g6gv-559v.json", "id": "GHSA-xvh5-g6gv-559v", "packages": ["Pillow"], "path": "advisories/github-reviewed/2026/10/GHSA-xvh5-g6gv-559v/GHSA-xvh5-g6gv-559v.json", "severity": "HIGH", "status": "changed", "summary": " Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags"}, {"advisory": "https://github.com/advisories/GHSA-5v64-555j-wjxm", "aliases": ["CVE-2026-125111"], "commit": "https://github.com/github/advisory-database/commit/2394f9ce1626106d6e7debd69ab1133e98e02171", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/2394f9ce1626106d6e7debd69ab1133e98e02171/advisories/github-reviewed/2026/11/GHSA-5v64-555j-wjxm/GHSA-5v64-555j-wjxm.json", "id": "GHSA-5v64-555j-wjxm", "packages": ["rack"], "path": "advisories/github-reviewed/2026/11/GHSA-5v64-555j-wjxm/GHSA-5v64-555j-wjxm.json", "severity": "HIGH", "status": "published", "summary": "Rack: Multipart parsing allows DoS via unbounded scan buffer growth"}, {"advisory": "https://github.com/advisories/GHSA-7xw9-549r-8jrc", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/7a194920c1404579546d821a5438e36b4ba15760", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/7a194920c1404579546d821a5438e36b4ba15760/advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json", "id": "GHSA-7xw9-549r-8jrc", "packages": ["DIRAC"], "path": "advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json", "severity": "HIGH", "status": "changed", "summary": "DIRAC: SQL injection and lack of access control in PilotManager service"}, {"advisory": "https://github.com/advisories/GHSA-m4m7-4cw8-62j6", "aliases": ["CVE-2026-61667"], "commit": "https://github.com/github/advisory-database/commit/7a194920c1404579546d821a5438e36b4ba15760", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/7a194920c1404579546d821a5438e36b4ba15760/advisories/github-reviewed/2026/07/GHSA-m4m7-4cw8-62j6/GHSA-m4m7-4cw8-62j6.json", "id": "GHSA-m4m7-4cw8-62j6", "packages": ["DIRAC"], "path": "advisories/github-reviewed/2026/07/GHSA-m4m7-4cw8-62j6/GHSA-m4m7-4cw8-62j6.json", "severity": "CRITICAL", "status": "changed", "summary": "DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval"}, {"advisory": "https://github.com/advisories/GHSA-vg99-gr89-qhw9", "aliases": ["CVE-2026-61668"], "commit": "https://github.com/github/advisory-database/commit/7a194920c1404579546d821a5438e36b4ba15760", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/7a194920c1404579546d821a5438e36b4ba15760/advisories/github-reviewed/2026/07/GHSA-vg99-gr89-qhw9/GHSA-vg99-gr89-qhw9.json", "id": "GHSA-vg99-gr89-qhw9", "packages": ["DIRAC"], "path": "advisories/github-reviewed/2026/07/GHSA-vg99-gr89-qhw9/GHSA-vg99-gr89-qhw9.json", "severity": "HIGH", "status": "changed", "summary": "DIRAC: Pilot code downloaded over unverified HTTPS connection"}, {"advisory": "https://github.com/advisories/GHSA-pcrw-h46h-c93h", "aliases": ["CVE-2026-125120"], "commit": "https://github.com/github/advisory-database/commit/7a194920c1404579546d821a5438e36b4ba15760", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7a194920c1404579546d821a5438e36b4ba15760/advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json", "id": "GHSA-pcrw-h46h-c93h", "packages": ["mongoose"], "path": "advisories/github-reviewed/2026/11/GHSA-pcrw-h46h-c93h/GHSA-pcrw-h46h-c93h.json", "severity": "CRITICAL", "status": "published", "summary": "Mongoose: sanitizeFilter not applied on countDocuments"}, {"advisory": "https://github.com/advisories/GHSA-9jpv-c7p4-997x", "aliases": ["CVE-2026-45579"], "commit": "https://github.com/github/advisory-database/commit/4dcabe15d1d58317dc03aaa66358d8fd33b0a423", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/4dcabe15d1d58317dc03aaa66358d8fd33b0a423/advisories/github-reviewed/2026/07/GHSA-9jpv-c7p4-997x/GHSA-9jpv-c7p4-997x.json", "id": "GHSA-9jpv-c7p4-997x", "packages": ["DIRAC"], "path": "advisories/github-reviewed/2026/07/GHSA-9jpv-c7p4-997x/GHSA-9jpv-c7p4-997x.json", "severity": "CRITICAL", "status": "changed", "summary": "DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input"}, {"advisory": "https://github.com/advisories/GHSA-w5f2-9q9c-ff4h", "aliases": ["CVE-2026-105192"], "commit": "https://github.com/github/advisory-database/commit/4dcabe15d1d58317dc03aaa66358d8fd33b0a423", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/4dcabe15d1d58317dc03aaa66358d8fd33b0a423/advisories/github-reviewed/2026/10/GHSA-w5f2-9q9c-ff4h/GHSA-w5f2-9q9c-ff4h.json", "id": "GHSA-w5f2-9q9c-ff4h", "packages": ["lmcache"], "path": "advisories/github-reviewed/2026/10/GHSA-w5f2-9q9c-ff4h/GHSA-w5f2-9q9c-ff4h.json", "severity": "CRITICAL", "status": "changed", "summary": "LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport"}, {"advisory": "https://github.com/advisories/GHSA-wwx6-x28x-8259", "aliases": ["CVE-2026-46702"], "commit": "https://github.com/github/advisory-database/commit/9d24ee4e688adb04f683b2009dcffa8361518d08", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/9d24ee4e688adb04f683b2009dcffa8361518d08/advisories/github-reviewed/2026/05/GHSA-wwx6-x28x-8259/GHSA-wwx6-x28x-8259.json", "id": "GHSA-wwx6-x28x-8259", "packages": ["russh"], "path": "advisories/github-reviewed/2026/05/GHSA-wwx6-x28x-8259/GHSA-wwx6-x28x-8259.json", "severity": "HIGH", "status": "changed", "summary": "russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets"}, {"advisory": "https://github.com/advisories/GHSA-m665-v7pm-7grj", "aliases": ["CVE-2026-115905"], "commit": "https://github.com/github/advisory-database/commit/9d24ee4e688adb04f683b2009dcffa8361518d08", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/9d24ee4e688adb04f683b2009dcffa8361518d08/advisories/github-reviewed/2026/10/GHSA-m665-v7pm-7grj/GHSA-m665-v7pm-7grj.json", "id": "GHSA-m665-v7pm-7grj", "packages": ["zip"], "path": "advisories/github-reviewed/2026/10/GHSA-m665-v7pm-7grj/GHSA-m665-v7pm-7grj.json", "severity": "CRITICAL", "status": "changed", "summary": "zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE"}, {"advisory": "https://github.com/advisories/GHSA-gg4r-jv3p-qx3c", "aliases": ["CVE-2026-125119"], "commit": "https://github.com/github/advisory-database/commit/16f530ccf17d2e537440d9be618fc50ef3f9184e", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/16f530ccf17d2e537440d9be618fc50ef3f9184e/advisories/github-reviewed/2026/11/GHSA-gg4r-jv3p-qx3c/GHSA-gg4r-jv3p-qx3c.json", "id": "GHSA-gg4r-jv3p-qx3c", "packages": ["mongoose"], "path": "advisories/github-reviewed/2026/11/GHSA-gg4r-jv3p-qx3c/GHSA-gg4r-jv3p-qx3c.json", "severity": "HIGH", "status": "published", "summary": "Mongoose: Connection-level sanitizeFilter not applied"}, {"advisory": "https://github.com/advisories/GHSA-fm29-4mq3-phg6", "aliases": ["CVE-2026-125337"], "commit": "https://github.com/github/advisory-database/commit/2b27bbc156da72a7a495aa73bf50e18f413eea86", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/2b27bbc156da72a7a495aa73bf50e18f413eea86/advisories/github-reviewed/2026/08/GHSA-fm29-4mq3-phg6/GHSA-fm29-4mq3-phg6.json", "id": "GHSA-fm29-4mq3-phg6", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-fm29-4mq3-phg6/GHSA-fm29-4mq3-phg6.json", "severity": "HIGH", "status": "changed", "summary": "Winter: ImportExportController AJAX handlers bypass granular import/export permission gate"}, {"advisory": "https://github.com/advisories/GHSA-5cwr-5jxg-pcf6", "aliases": ["CVE-2026-125338"], "commit": "https://github.com/github/advisory-database/commit/8eaca8633958dcf9f5468b860112e853d15db342", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/8eaca8633958dcf9f5468b860112e853d15db342/advisories/github-reviewed/2026/08/GHSA-5cwr-5jxg-pcf6/GHSA-5cwr-5jxg-pcf6.json", "id": "GHSA-5cwr-5jxg-pcf6", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-5cwr-5jxg-pcf6/GHSA-5cwr-5jxg-pcf6.json", "severity": "MODERATE", "status": "changed", "summary": "Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles"}, {"advisory": "https://github.com/advisories/GHSA-p2ch-c2c3-4xm5", "aliases": ["CVE-2026-125339"], "commit": "https://github.com/github/advisory-database/commit/8eaca8633958dcf9f5468b860112e853d15db342", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/8eaca8633958dcf9f5468b860112e853d15db342/advisories/github-reviewed/2026/08/GHSA-p2ch-c2c3-4xm5/GHSA-p2ch-c2c3-4xm5.json", "id": "GHSA-p2ch-c2c3-4xm5", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-p2ch-c2c3-4xm5/GHSA-p2ch-c2c3-4xm5.json", "severity": "MODERATE", "status": "changed", "summary": "Winter: CSRF through AJAX handler names reachable as backend page actions"}, {"advisory": "https://github.com/advisories/GHSA-7mpf-4465-7fc2", "aliases": ["CVE-2026-125341"], "commit": "https://github.com/github/advisory-database/commit/16139f31cf479516b4169e8da4197810c7c1f0ef", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/16139f31cf479516b4169e8da4197810c7c1f0ef/advisories/github-reviewed/2026/08/GHSA-7mpf-4465-7fc2/GHSA-7mpf-4465-7fc2.json", "id": "GHSA-7mpf-4465-7fc2", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-7mpf-4465-7fc2/GHSA-7mpf-4465-7fc2.json", "severity": "LOW", "status": "changed", "summary": "Winter: Stored XSS through Backend List widget image columns"}, {"advisory": "https://github.com/advisories/GHSA-hq84-x37p-j6q5", "aliases": ["CVE-2026-125340"], "commit": "https://github.com/github/advisory-database/commit/16139f31cf479516b4169e8da4197810c7c1f0ef", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/16139f31cf479516b4169e8da4197810c7c1f0ef/advisories/github-reviewed/2026/08/GHSA-hq84-x37p-j6q5/GHSA-hq84-x37p-j6q5.json", "id": "GHSA-hq84-x37p-j6q5", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-hq84-x37p-j6q5/GHSA-hq84-x37p-j6q5.json", "severity": "MODERATE", "status": "changed", "summary": "Winter: Reflected XSS through the search query parameter in the backend Table widget"}, {"advisory": "https://github.com/advisories/GHSA-mpmw-f6h6-3g26", "aliases": ["CVE-2026-126061"], "commit": "https://github.com/github/advisory-database/commit/16139f31cf479516b4169e8da4197810c7c1f0ef", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/16139f31cf479516b4169e8da4197810c7c1f0ef/advisories/github-reviewed/2026/08/GHSA-mpmw-f6h6-3g26/GHSA-mpmw-f6h6-3g26.json", "id": "GHSA-mpmw-f6h6-3g26", "packages": ["winter/wn-backend-module"], "path": "advisories/github-reviewed/2026/08/GHSA-mpmw-f6h6-3g26/GHSA-mpmw-f6h6-3g26.json", "severity": "MODERATE", "status": "changed", "summary": "Winter: My Account preview exposes another backend user's profile by record ID"}, {"advisory": "https://github.com/advisories/GHSA-6972-9mcm-vhwj", "aliases": ["CVE-2026-125118"], "commit": "https://github.com/github/advisory-database/commit/f2525f5841e21f85dfa6f4ed81dadccea36ea91a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/f2525f5841e21f85dfa6f4ed81dadccea36ea91a/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json", "id": "GHSA-6972-9mcm-vhwj", "packages": ["mongoose"], "path": "advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json", "severity": "MODERATE", "status": "published", "summary": "Mongoose: Prototype pollution via Schema.prototype.virtual()"}, {"advisory": "https://github.com/advisories/GHSA-4p39-36wj-23h4", "aliases": ["CVE-2026-126063"], "commit": "https://github.com/github/advisory-database/commit/6e479a4c0cc81ce990a5def8c5dfa4ab4d704753", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/6e479a4c0cc81ce990a5def8c5dfa4ab4d704753/advisories/github-reviewed/2026/11/GHSA-4p39-36wj-23h4/GHSA-4p39-36wj-23h4.json", "id": "GHSA-4p39-36wj-23h4", "packages": ["nokogiri"], "path": "advisories/github-reviewed/2026/11/GHSA-4p39-36wj-23h4/GHSA-4p39-36wj-23h4.json", "severity": "LOW", "status": "published", "summary": "Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer"}, {"advisory": "https://github.com/advisories/GHSA-3w22-6jfg-527w", "aliases": ["CVE-2026-126064"], "commit": "https://github.com/github/advisory-database/commit/64bde5358938239cda0eb3a28eeeba01143630d5", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/64bde5358938239cda0eb3a28eeeba01143630d5/advisories/github-reviewed/2026/11/GHSA-3w22-6jfg-527w/GHSA-3w22-6jfg-527w.json", "id": "GHSA-3w22-6jfg-527w", "packages": ["nokogiri"], "path": "advisories/github-reviewed/2026/11/GHSA-3w22-6jfg-527w/GHSA-3w22-6jfg-527w.json", "severity": "LOW", "status": "published", "summary": "Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value"}, {"advisory": "https://github.com/advisories/GHSA-v995-44v6-5fqm", "aliases": ["CVE-2026-126062"], "commit": "https://github.com/github/advisory-database/commit/64bde5358938239cda0eb3a28eeeba01143630d5", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/64bde5358938239cda0eb3a28eeeba01143630d5/advisories/github-reviewed/2026/11/GHSA-v995-44v6-5fqm/GHSA-v995-44v6-5fqm.json", "id": "GHSA-v995-44v6-5fqm", "packages": ["nokogiri"], "path": "advisories/github-reviewed/2026/11/GHSA-v995-44v6-5fqm/GHSA-v995-44v6-5fqm.json", "severity": "LOW", "status": "published", "summary": "JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host"}, {"advisory": "https://github.com/advisories/GHSA-8332-j7wj-wjw4", "aliases": ["CVE-2026-125117"], "commit": "https://github.com/github/advisory-database/commit/8f116a86d87b548e74d3a3a7c98717acf0e71ece", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/8f116a86d87b548e74d3a3a7c98717acf0e71ece/advisories/github-reviewed/2026/11/GHSA-8332-j7wj-wjw4/GHSA-8332-j7wj-wjw4.json", "id": "GHSA-8332-j7wj-wjw4", "packages": ["mongoose"], "path": "advisories/github-reviewed/2026/11/GHSA-8332-j7wj-wjw4/GHSA-8332-j7wj-wjw4.json", "severity": "HIGH", "status": "published", "summary": "Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state"}, {"advisory": "https://github.com/advisories/GHSA-wr5m-5jph-8m96", "aliases": ["CVE-2026-125116"], "commit": "https://github.com/github/advisory-database/commit/6a7bebcf3498db7fdcf4b37e5a153c4c3d4f8d64", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/6a7bebcf3498db7fdcf4b37e5a153c4c3d4f8d64/advisories/github-reviewed/2026/11/GHSA-wr5m-5jph-8m96/GHSA-wr5m-5jph-8m96.json", "id": "GHSA-wr5m-5jph-8m96", "packages": ["mongoose"], "path": "advisories/github-reviewed/2026/11/GHSA-wr5m-5jph-8m96/GHSA-wr5m-5jph-8m96.json", "severity": "MODERATE", "status": "published", "summary": "Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections"}, {"advisory": "https://github.com/advisories/GHSA-474x-hrwr-fgx4", "aliases": ["CVE-2026-126066"], "commit": "https://github.com/github/advisory-database/commit/7f16e6e8a374a5674859808ddd08b7680c2f3b3f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7f16e6e8a374a5674859808ddd08b7680c2f3b3f/advisories/github-reviewed/2026/11/GHSA-474x-hrwr-fgx4/GHSA-474x-hrwr-fgx4.json", "id": "GHSA-474x-hrwr-fgx4", "packages": ["fast-xml-parser"], "path": "advisories/github-reviewed/2026/11/GHSA-474x-hrwr-fgx4/GHSA-474x-hrwr-fgx4.json", "severity": "LOW", "status": "published", "summary": "fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags"}, {"advisory": "https://github.com/advisories/GHSA-j8rw-jp99-435v", "aliases": ["CVE-2026-125334"], "commit": "https://github.com/github/advisory-database/commit/fc9d9d012f507f04d8546fd5e372490072c80fa1", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/fc9d9d012f507f04d8546fd5e372490072c80fa1/advisories/github-reviewed/2026/11/GHSA-j8rw-jp99-435v/GHSA-j8rw-jp99-435v.json", "id": "GHSA-j8rw-jp99-435v", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-j8rw-jp99-435v/GHSA-j8rw-jp99-435v.json", "severity": "MODERATE", "status": "published", "summary": "Forge: TLS client crash on a handshake record received without a session"}, {"advisory": "https://github.com/advisories/GHSA-6889-vf6x-f3g5", "aliases": ["CVE-2026-125335"], "commit": "https://github.com/github/advisory-database/commit/ab1a6afca6364e36fbf4238b8673e9bbfb77629a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/ab1a6afca6364e36fbf4238b8673e9bbfb77629a/advisories/github-reviewed/2026/11/GHSA-6889-vf6x-f3g5/GHSA-6889-vf6x-f3g5.json", "id": "GHSA-6889-vf6x-f3g5", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-6889-vf6x-f3g5/GHSA-6889-vf6x-f3g5.json", "severity": "LOW", "status": "published", "summary": "Forge: Ed25519 signature verification accepts small-order public keys"}, {"advisory": "https://github.com/advisories/GHSA-6cv4-p8m7-4r25", "aliases": ["CVE-2026-125333"], "commit": "https://github.com/github/advisory-database/commit/ab1a6afca6364e36fbf4238b8673e9bbfb77629a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/ab1a6afca6364e36fbf4238b8673e9bbfb77629a/advisories/github-reviewed/2026/11/GHSA-6cv4-p8m7-4r25/GHSA-6cv4-p8m7-4r25.json", "id": "GHSA-6cv4-p8m7-4r25", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-6cv4-p8m7-4r25/GHSA-6cv4-p8m7-4r25.json", "severity": "MODERATE", "status": "published", "summary": "Forge: ReDoS in forge.http response header and cookie trimming"}, {"advisory": "https://github.com/advisories/GHSA-w4xr-hqv8-ch44", "aliases": ["CVE-2026-125332"], "commit": "https://github.com/github/advisory-database/commit/ab1a6afca6364e36fbf4238b8673e9bbfb77629a", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/ab1a6afca6364e36fbf4238b8673e9bbfb77629a/advisories/github-reviewed/2026/11/GHSA-w4xr-hqv8-ch44/GHSA-w4xr-hqv8-ch44.json", "id": "GHSA-w4xr-hqv8-ch44", "packages": ["node-forge"], "path": "advisories/github-reviewed/2026/11/GHSA-w4xr-hqv8-ch44/GHSA-w4xr-hqv8-ch44.json", "severity": "MODERATE", "status": "published", "summary": "Forge: TLS client crash on an unsupported ServerHello compression method"}, {"advisory": "https://github.com/advisories/GHSA-2586-8ghr-69fj", "aliases": ["CVE-2026-126076"], "commit": "https://github.com/github/advisory-database/commit/7c36b233a1ac24626d0b7533780316105e32f35c", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/7c36b233a1ac24626d0b7533780316105e32f35c/advisories/github-reviewed/2026/11/GHSA-2586-8ghr-69fj/GHSA-2586-8ghr-69fj.json", "id": "GHSA-2586-8ghr-69fj", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-2586-8ghr-69fj/GHSA-2586-8ghr-69fj.json", "severity": "MODERATE", "status": "published", "summary": "Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore"}, {"advisory": "https://github.com/advisories/GHSA-2gff-2mmg-m73p", "aliases": ["CVE-2026-126083"], "commit": "https://github.com/github/advisory-database/commit/7c36b233a1ac24626d0b7533780316105e32f35c", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/7c36b233a1ac24626d0b7533780316105e32f35c/advisories/github-reviewed/2026/11/GHSA-2gff-2mmg-m73p/GHSA-2gff-2mmg-m73p.json", "id": "GHSA-2gff-2mmg-m73p", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-2gff-2mmg-m73p/GHSA-2gff-2mmg-m73p.json", "severity": "HIGH", "status": "published", "summary": "Action Pack: Possible IP spoofing in Action Dispatch RemoteIp"}, {"advisory": "https://github.com/advisories/GHSA-2w9f-fxwj-w2qf", "aliases": ["CVE-2026-126075"], "commit": "https://github.com/github/advisory-database/commit/cb681a043eb3113ab5845cb2bdbc3186bcbc682b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb681a043eb3113ab5845cb2bdbc3186bcbc682b/advisories/github-reviewed/2026/11/GHSA-2w9f-fxwj-w2qf/GHSA-2w9f-fxwj-w2qf.json", "id": "GHSA-2w9f-fxwj-w2qf", "packages": ["activesupport"], "path": "advisories/github-reviewed/2026/11/GHSA-2w9f-fxwj-w2qf/GHSA-2w9f-fxwj-w2qf.json", "severity": "MODERATE", "status": "published", "summary": "Active Support: Possible XSS vulnerability in Active Support MessagePack serializer"}, {"advisory": "https://github.com/advisories/GHSA-4v2w-w6g6-f8f8", "aliases": ["CVE-2026-126071"], "commit": "https://github.com/github/advisory-database/commit/cb681a043eb3113ab5845cb2bdbc3186bcbc682b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb681a043eb3113ab5845cb2bdbc3186bcbc682b/advisories/github-reviewed/2026/11/GHSA-4v2w-w6g6-f8f8/GHSA-4v2w-w6g6-f8f8.json", "id": "GHSA-4v2w-w6g6-f8f8", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-4v2w-w6g6-f8f8/GHSA-4v2w-w6g6-f8f8.json", "severity": "MODERATE", "status": "published", "summary": "Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming"}, {"advisory": "https://github.com/advisories/GHSA-5957-c7qm-m469", "aliases": ["CVE-2026-126068"], "commit": "https://github.com/github/advisory-database/commit/cb681a043eb3113ab5845cb2bdbc3186bcbc682b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb681a043eb3113ab5845cb2bdbc3186bcbc682b/advisories/github-reviewed/2026/11/GHSA-5957-c7qm-m469/GHSA-5957-c7qm-m469.json", "id": "GHSA-5957-c7qm-m469", "packages": ["actionmailbox"], "path": "advisories/github-reviewed/2026/11/GHSA-5957-c7qm-m469/GHSA-5957-c7qm-m469.json", "severity": "LOW", "status": "published", "summary": "Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress"}, {"advisory": "https://github.com/advisories/GHSA-gmj8-hvj3-49mw", "aliases": ["CVE-2026-126067"], "commit": "https://github.com/github/advisory-database/commit/cb681a043eb3113ab5845cb2bdbc3186bcbc682b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb681a043eb3113ab5845cb2bdbc3186bcbc682b/advisories/github-reviewed/2026/11/GHSA-gmj8-hvj3-49mw/GHSA-gmj8-hvj3-49mw.json", "id": "GHSA-gmj8-hvj3-49mw", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-gmj8-hvj3-49mw/GHSA-gmj8-hvj3-49mw.json", "severity": "LOW", "status": "published", "summary": "Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores"}, {"advisory": "https://github.com/advisories/GHSA-r9jg-fmfx-2gv6", "aliases": ["CVE-2026-126073"], "commit": "https://github.com/github/advisory-database/commit/cb681a043eb3113ab5845cb2bdbc3186bcbc682b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb681a043eb3113ab5845cb2bdbc3186bcbc682b/advisories/github-reviewed/2026/11/GHSA-r9jg-fmfx-2gv6/GHSA-r9jg-fmfx-2gv6.json", "id": "GHSA-r9jg-fmfx-2gv6", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-r9jg-fmfx-2gv6/GHSA-r9jg-fmfx-2gv6.json", "severity": "MODERATE", "status": "published", "summary": "Action Pack: Possible cache poisoning in Action Pack content negotiation"}, {"advisory": "https://github.com/advisories/GHSA-p2pm-g2h6-7j5j", "aliases": ["CVE-2026-126074"], "commit": "https://github.com/github/advisory-database/commit/9311d3982ad98c6bbfe7e47db2fd9e20340a3950", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/9311d3982ad98c6bbfe7e47db2fd9e20340a3950/advisories/github-reviewed/2026/11/GHSA-p2pm-g2h6-7j5j/GHSA-p2pm-g2h6-7j5j.json", "id": "GHSA-p2pm-g2h6-7j5j", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-p2pm-g2h6-7j5j/GHSA-p2pm-g2h6-7j5j.json", "severity": "MODERATE", "status": "published", "summary": "Active Storage: Possible DoS vulnerability in Active Storage filename handling"}, {"advisory": "https://github.com/advisories/GHSA-8474-xrp6-wh69", "aliases": ["CVE-2026-126080"], "commit": "https://github.com/github/advisory-database/commit/f7731de3715541ceb5dbd704e64ea21a7ab2544e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/f7731de3715541ceb5dbd704e64ea21a7ab2544e/advisories/github-reviewed/2026/11/GHSA-8474-xrp6-wh69/GHSA-8474-xrp6-wh69.json", "id": "GHSA-8474-xrp6-wh69", "packages": ["activesupport"], "path": "advisories/github-reviewed/2026/11/GHSA-8474-xrp6-wh69/GHSA-8474-xrp6-wh69.json", "severity": "HIGH", "status": "published", "summary": "Active Support: Possible DoS vulnerability in Active Support safe_constantize"}, {"advisory": "https://github.com/advisories/GHSA-hfr4-8rjc-97m2", "aliases": ["CVE-2026-126085"], "commit": "https://github.com/github/advisory-database/commit/f7731de3715541ceb5dbd704e64ea21a7ab2544e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/f7731de3715541ceb5dbd704e64ea21a7ab2544e/advisories/github-reviewed/2026/11/GHSA-hfr4-8rjc-97m2/GHSA-hfr4-8rjc-97m2.json", "id": "GHSA-hfr4-8rjc-97m2", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-hfr4-8rjc-97m2/GHSA-hfr4-8rjc-97m2.json", "severity": "MODERATE", "status": "published", "summary": "Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage"}, {"advisory": "https://github.com/advisories/GHSA-v924-7rp8-4mxh", "aliases": ["CVE-2026-126186"], "commit": "https://github.com/github/advisory-database/commit/f7731de3715541ceb5dbd704e64ea21a7ab2544e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/f7731de3715541ceb5dbd704e64ea21a7ab2544e/advisories/github-reviewed/2026/11/GHSA-v924-7rp8-4mxh/GHSA-v924-7rp8-4mxh.json", "id": "GHSA-v924-7rp8-4mxh", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-v924-7rp8-4mxh/GHSA-v924-7rp8-4mxh.json", "severity": "HIGH", "status": "published", "summary": "Active Storage: Possible arbitrary file read and remote code execution in video previews, analysis and image processing"}, {"advisory": "https://github.com/advisories/GHSA-hr4h-4c45-v4q4", "aliases": ["CVE-2026-125122"], "commit": "https://github.com/github/advisory-database/commit/77aa58c7ee161e8f62b18b3e15ec6d1e3e5c3343", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/77aa58c7ee161e8f62b18b3e15ec6d1e3e5c3343/advisories/github-reviewed/2026/11/GHSA-hr4h-4c45-v4q4/GHSA-hr4h-4c45-v4q4.json", "id": "GHSA-hr4h-4c45-v4q4", "packages": ["compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-hr4h-4c45-v4q4/GHSA-hr4h-4c45-v4q4.json", "severity": "LOW", "status": "published", "summary": "compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout"}, {"advisory": "https://github.com/advisories/GHSA-xcf7-88g6-7xr8", "aliases": ["CVE-2026-125125"], "commit": "https://github.com/github/advisory-database/commit/209394ddea3bc54942497fec4bdeff952d05931e", "ecosystems": ["GitHub Actions"], "file": "https://github.com/github/advisory-database/blob/209394ddea3bc54942497fec4bdeff952d05931e/advisories/github-reviewed/2026/11/GHSA-xcf7-88g6-7xr8/GHSA-xcf7-88g6-7xr8.json", "id": "GHSA-xcf7-88g6-7xr8", "packages": ["tmatens/compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-xcf7-88g6-7xr8/GHSA-xcf7-88g6-7xr8.json", "severity": "LOW", "status": "published", "summary": "\u00a0compose-lint: Workflow command injection through SARIF-directory errors triggered by pull request symlinks\u00a0"}, {"advisory": "https://github.com/advisories/GHSA-8v59-qmwv-4p6q", "aliases": ["CVE-2026-125123"], "commit": "https://github.com/github/advisory-database/commit/6e2272eece174cc64c159d2b948fce1b2e054144", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/6e2272eece174cc64c159d2b948fce1b2e054144/advisories/github-reviewed/2026/11/GHSA-8v59-qmwv-4p6q/GHSA-8v59-qmwv-4p6q.json", "id": "GHSA-8v59-qmwv-4p6q", "packages": ["compose-lint"], "path": "advisories/github-reviewed/2026/11/GHSA-8v59-qmwv-4p6q/GHSA-8v59-qmwv-4p6q.json", "severity": "LOW", "status": "published", "summary": "compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages\u00a0"}, {"advisory": "https://github.com/advisories/GHSA-gxg8-5rwf-cg43", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/f8ec22dd382f14b3f0ce1ac11429fe142752059a", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/f8ec22dd382f14b3f0ce1ac11429fe142752059a/advisories/github-reviewed/2026/11/GHSA-gxg8-5rwf-cg43/GHSA-gxg8-5rwf-cg43.json", "id": "GHSA-gxg8-5rwf-cg43", "packages": ["Microsoft.AspNetCore.SignalR.StackExchangeRedis"], "path": "advisories/github-reviewed/2026/11/GHSA-gxg8-5rwf-cg43/GHSA-gxg8-5rwf-cg43.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-49q5-vjx7-5gwr", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/241dce85c2d001b5e29ae8d6c6a963258be8de0d", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/241dce85c2d001b5e29ae8d6c6a963258be8de0d/advisories/github-reviewed/2026/11/GHSA-49q5-vjx7-5gwr/GHSA-49q5-vjx7-5gwr.json", "id": "GHSA-49q5-vjx7-5gwr", "packages": ["Microsoft.AspNetCore.Server.HttpSys"], "path": "advisories/github-reviewed/2026/11/GHSA-49q5-vjx7-5gwr/GHSA-49q5-vjx7-5gwr.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-c827-j3xf-67v6", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/654004458bcb7b834039d01e06e4b55b17b8b097", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/654004458bcb7b834039d01e06e4b55b17b8b097/advisories/github-reviewed/2026/11/GHSA-c827-j3xf-67v6/GHSA-c827-j3xf-67v6.json", "id": "GHSA-c827-j3xf-67v6", "packages": ["Microsoft.AspNetCore.App.Runtime.linux-arm"], "path": "advisories/github-reviewed/2026/11/GHSA-c827-j3xf-67v6/GHSA-c827-j3xf-67v6.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-114156 - ASP.NET Core Security Feature Bypass Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-95x6-7hq8-2c37", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/9cbf3190c1063686a3fad5940b9b9ee7dc5995cc", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/9cbf3190c1063686a3fad5940b9b9ee7dc5995cc/advisories/github-reviewed/2026/11/GHSA-95x6-7hq8-2c37/GHSA-95x6-7hq8-2c37.json", "id": "GHSA-95x6-7hq8-2c37", "packages": ["Microsoft.AspNetCore.App.Runtime.win-arm64"], "path": "advisories/github-reviewed/2026/11/GHSA-95x6-7hq8-2c37/GHSA-95x6-7hq8-2c37.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-hfpm-4fc4-g2wc", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/9cbf3190c1063686a3fad5940b9b9ee7dc5995cc", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/9cbf3190c1063686a3fad5940b9b9ee7dc5995cc/advisories/github-reviewed/2026/11/GHSA-hfpm-4fc4-g2wc/GHSA-hfpm-4fc4-g2wc.json", "id": "GHSA-hfpm-4fc4-g2wc", "packages": ["Aspire.Cli"], "path": "advisories/github-reviewed/2026/11/GHSA-hfpm-4fc4-g2wc/GHSA-hfpm-4fc4-g2wc.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-fgfw-85w4-gx99", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/98f73dd75a92b1405f17f7d9b5733cbd50b83899", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/98f73dd75a92b1405f17f7d9b5733cbd50b83899/advisories/github-reviewed/2026/11/GHSA-fgfw-85w4-gx99/GHSA-fgfw-85w4-gx99.json", "id": "GHSA-fgfw-85w4-gx99", "packages": ["Aspire.Cli"], "path": "advisories/github-reviewed/2026/11/GHSA-fgfw-85w4-gx99/GHSA-fgfw-85w4-gx99.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-xqc2-xf4c-x3h3", "aliases": ["CVE-2026-126187"], "commit": "https://github.com/github/advisory-database/commit/63b06bf89edea693fa33443d9a6359dfd1d3887d", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/63b06bf89edea693fa33443d9a6359dfd1d3887d/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json", "id": "GHSA-xqc2-xf4c-x3h3", "packages": ["react-server-dom-parcel", "react-server-dom-turbopack", "react-server-dom-webpack"], "path": "advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json", "severity": "CRITICAL", "status": "published", "summary": "React: Unauthenticated Remote Code Execution in React Server Components"}, {"advisory": "https://github.com/advisories/GHSA-xhj5-c3g8-pfj8", "aliases": ["CVE-2026-109476"], "commit": "https://github.com/github/advisory-database/commit/7401bd2baf91ec1a0e8bf15386c32a6cb186a928", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/7401bd2baf91ec1a0e8bf15386c32a6cb186a928/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json", "id": "GHSA-xhj5-c3g8-pfj8", "packages": ["Microsoft.AspNetCore.App.Runtime.linux-arm", "Microsoft.AspNetCore.App.Runtime.linux-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "Microsoft.AspNetCore.App.Runtime.linux-x64", "Microsoft.AspNetCore.App.Runtime.osx-arm64", "Microsoft.AspNetCore.App.Runtime.osx-x64", "Microsoft.AspNetCore.App.Runtime.win-arm64", "Microsoft.AspNetCore.App.Runtime.win-x64", "Microsoft.AspNetCore.App.Runtime.win-x86"], "path": "advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-109476 - ASP.NET Core Information Disclosure Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-x33c-w48q-qrgc", "aliases": ["CVE-2026-114149"], "commit": "https://github.com/github/advisory-database/commit/c12fb372d150a1e2d93646929a18146cda8f5a29", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/c12fb372d150a1e2d93646929a18146cda8f5a29/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json", "id": "GHSA-x33c-w48q-qrgc", "packages": ["Microsoft.AspNetCore.App.Runtime.linux-arm", "Microsoft.AspNetCore.App.Runtime.linux-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "Microsoft.AspNetCore.App.Runtime.linux-x64", "Microsoft.AspNetCore.App.Runtime.osx-arm64", "Microsoft.AspNetCore.App.Runtime.osx-x64", "Microsoft.AspNetCore.App.Runtime.win-arm64", "Microsoft.AspNetCore.App.Runtime.win-x64", "Microsoft.AspNetCore.App.Runtime.win-x86", "Microsoft.AspNetCore.WebUtilities"], "path": "advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json", "severity": "HIGH", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-114149 - ASP.NET Core Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-m28h-pj36-4364", "aliases": ["CVE-2026-118749"], "commit": "https://github.com/github/advisory-database/commit/7de9e61011d0d93daf0476155d8141df98aa7819", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/7de9e61011d0d93daf0476155d8141df98aa7819/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json", "id": "GHSA-m28h-pj36-4364", "packages": ["Microsoft.AspNetCore.App.Runtime.linux-arm", "Microsoft.AspNetCore.App.Runtime.linux-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "Microsoft.AspNetCore.App.Runtime.linux-x64", "Microsoft.AspNetCore.App.Runtime.osx-arm64", "Microsoft.AspNetCore.App.Runtime.osx-x64", "Microsoft.AspNetCore.App.Runtime.win-arm64", "Microsoft.AspNetCore.App.Runtime.win-x64", "Microsoft.AspNetCore.App.Runtime.win-x86", "Microsoft.Extensions.Validation"], "path": "advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-118749 - ASP.NET Core Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-vmv3-wvjp-wqpj", "aliases": ["CVE-2026-118747"], "commit": "https://github.com/github/advisory-database/commit/9276e05b9b31b4c33c7249c9e48e21b29b52cd9b", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/9276e05b9b31b4c33c7249c9e48e21b29b52cd9b/advisories/github-reviewed/2026/11/GHSA-vmv3-wvjp-wqpj/GHSA-vmv3-wvjp-wqpj.json", "id": "GHSA-vmv3-wvjp-wqpj", "packages": ["System.Formats.Cbor"], "path": "advisories/github-reviewed/2026/11/GHSA-vmv3-wvjp-wqpj/GHSA-vmv3-wvjp-wqpj.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-118747 - .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-3g4v-f5gv-c7xf", "aliases": ["CVE-2026-109475"], "commit": "https://github.com/github/advisory-database/commit/c528c4a7d1a9b85f54242a979ece46f2e26e24d1", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/c528c4a7d1a9b85f54242a979ece46f2e26e24d1/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json", "id": "GHSA-3g4v-f5gv-c7xf", "packages": ["Microsoft.NETCore.App.Runtime.linux-arm", "Microsoft.NETCore.App.Runtime.linux-arm64", "Microsoft.NETCore.App.Runtime.linux-musl-arm", "Microsoft.NETCore.App.Runtime.linux-musl-arm64", "Microsoft.NETCore.App.Runtime.linux-musl-x64", "Microsoft.NETCore.App.Runtime.linux-x64", "Microsoft.NETCore.App.Runtime.osx-arm64", "Microsoft.NETCore.App.Runtime.osx-x64"], "path": "advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-109475 - .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-cpw3-h88j-9f6x", "aliases": ["CVE-2026-120796"], "commit": "https://github.com/github/advisory-database/commit/c528c4a7d1a9b85f54242a979ece46f2e26e24d1", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/c528c4a7d1a9b85f54242a979ece46f2e26e24d1/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json", "id": "GHSA-cpw3-h88j-9f6x", "packages": ["Microsoft.NETCore.App.Runtime.linux-arm", "Microsoft.NETCore.App.Runtime.linux-arm64", "Microsoft.NETCore.App.Runtime.linux-musl-arm", "Microsoft.NETCore.App.Runtime.linux-musl-arm64", "Microsoft.NETCore.App.Runtime.linux-musl-x64", "Microsoft.NETCore.App.Runtime.linux-x64", "Microsoft.NETCore.App.Runtime.osx-arm64", "Microsoft.NETCore.App.Runtime.osx-x64", "Microsoft.NETCore.App.Runtime.win-arm64", "Microsoft.NETCore.App.Runtime.win-x64", "Microsoft.NETCore.App.Runtime.win-x86", "System.Text.Json"], "path": "advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-f7vh-h5g3-7jrh", "aliases": ["CVE-2026-120006"], "commit": "https://github.com/github/advisory-database/commit/c528c4a7d1a9b85f54242a979ece46f2e26e24d1", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/c528c4a7d1a9b85f54242a979ece46f2e26e24d1/advisories/github-reviewed/2026/11/GHSA-f7vh-h5g3-7jrh/GHSA-f7vh-h5g3-7jrh.json", "id": "GHSA-f7vh-h5g3-7jrh", "packages": ["Aspire.Hosting.AppHost", "Aspire.Hosting"], "path": "advisories/github-reviewed/2026/11/GHSA-f7vh-h5g3-7jrh/GHSA-f7vh-h5g3-7jrh.json", "severity": "HIGH", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-120006 - Aspire Elevation of Privilege Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-6527-9fp8-r4x6", "aliases": ["CVE-2026-118750"], "commit": "https://github.com/github/advisory-database/commit/9672de6eda406b2becc926ca6a39073659fa910d", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/9672de6eda406b2becc926ca6a39073659fa910d/advisories/github-reviewed/2026/11/GHSA-6527-9fp8-r4x6/GHSA-6527-9fp8-r4x6.json", "id": "GHSA-6527-9fp8-r4x6", "packages": ["Microsoft.AspNetCore.WebUtilities"], "path": "advisories/github-reviewed/2026/11/GHSA-6527-9fp8-r4x6/GHSA-6527-9fp8-r4x6.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-118750 - ASP.NET Core Denial of Service Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-xw2x-23jm-j582", "aliases": ["CVE-2026-109481"], "commit": "https://github.com/github/advisory-database/commit/3259e2adc67907723c9a928f5badc5a6fd99cca9", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/3259e2adc67907723c9a928f5badc5a6fd99cca9/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json", "id": "GHSA-xw2x-23jm-j582", "packages": ["Microsoft.AspNetCore.App.Runtime.linux-arm", "Microsoft.AspNetCore.App.Runtime.linux-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "Microsoft.AspNetCore.App.Runtime.linux-x64", "Microsoft.AspNetCore.App.Runtime.osx-arm64", "Microsoft.AspNetCore.App.Runtime.osx-x64", "Microsoft.AspNetCore.App.Runtime.win-arm64", "Microsoft.AspNetCore.App.Runtime.win-x64", "Microsoft.AspNetCore.App.Runtime.win-x86"], "path": "advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json", "severity": "MODERATE", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-109481 - ASP.NET Core Elevation of Privilege Vulnerability"}], "sourceId": "advisories-reviewed", "text": "On November 10, 2026, GitHub's security advisory list published 74 new advisories, changed 20, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 68919, "fingerprint": "ccb788816f3a14a056719c5c0fe492c2823ef8b5df6db7be10c475195dfe393d", "url": "https://flarereef.flareforward.com/files/watch/ccb788816f3a14a056719c5c0fe492c2823ef8b5df6db7be10c475195dfe393d.json"}}, "project": {"projectId": 20, "name": "Security advisories (GitHub reviewed)", "kind": "watch", "keeper": "GitHub", "jurisdiction": "", "markText": "GH", "shape": "", "what": "GitHub's security advisory list", "repoUrl": "https://github.com/github/advisory-database", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "chunk": "day"}, "date": "2026-11-11", "author": {"name": "Flare Reef watcher", "handle": "", "verified": false}}