{"note": {"noteId": 465, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0x0362122b24460483817ff126474f8058f19956320b2167f3a60e50b92016242e", "content": "{\"counts\":{\"changed\":5,\"published\":49,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-12\",\"fullList\":{\"bytes\":37671,\"fingerprint\":\"d33fc92b80c9cf10b05024e7fb3ee84e6fe879a86abd1f4c9c6ee9e19f45d429\",\"url\":\"https://flarereef.flareforward.com/files/watch/d33fc92b80c9cf10b05024e7fb3ee84e6fe879a86abd1f4c9c6ee9e19f45d429.json\"},\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-13T02:10:10Z\",\"rows\":[{\"advisory\":\"https://github.com/advisories/GHSA-45c3-73f7-pv4m\",\"aliases\":[\"CVE-2026-114605\"],\"commit\":\"https://github.com/github/advisory-database/commit/f5be53f06dad97347eec89ab395f4e6028136fcd\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/f5be53f06dad97347eec89ab395f4e6028136fcd/advisories/github-reviewed/2026/10/GHSA-45c3-73f7-pv4m/GHSA-45c3-73f7-pv4m.json\",\"id\":\"GHSA-45c3-73f7-pv4m\",\"packages\":[\"dnspython\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-45c3-73f7-pv4m/GHSA-45c3-73f7-pv4m.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"dnspython dns.name.from_wire_parser() excessive CPU use\"},{\"advisory\":\"https://github.com/advisories/GHSA-w4f7-4cxr-rv3c\",\"aliases\":[\"CVE-2026-43966\"],\"commit\":\"https://github.com/github/advisory-database/commit/8907a85b8b570b2cb95b3819d70d2290b29630c7\",\"ecosystems\":[\"Hex\"],\"file\":\"https://github.com/github/advisory-database/blob/8907a85b8b570b2cb95b3819d70d2290b29630c7/advisories/github-reviewed/2026/06/GHSA-w4f7-4cxr-rv3c/GHSA-w4f7-4cxr-rv3c.json\",\"id\":\"GHSA-w4f7-4cxr-rv3c\",\"packages\":[\"cowboy\",\"gun\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-w4f7-4cxr-rv3c/GHSA-w4f7-4cxr-rv3c.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"cowboy and gun affected by an HTTP Request/Response Splitting vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-2f3w-v7f5-vpgx\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/f0849a6e194453b260479b27b5926cba75c63e18\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/f0849a6e194453b260479b27b5926cba75c63e18/advisories/github-reviewed/2026/11/GHSA-2f3w-v7f5-vpgx/GHSA-2f3w-v7f5-vpgx.json\",\"id\":\"GHSA-2f3w-v7f5-vpgx\",\"packages\":[\"Aspire.Dashboard.Sdk.linux-x64\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-2f3w-v7f5-vpgx/GHSA-2f3w-v7f5-vpgx.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-4g86-54fm-h9h8\",\"aliases\":[\"CVE-2026-118740\"],\"commit\":\"https://github.com/github/advisory-database/commit/e560792cfcc09ff52eef424829c580acdce034f9\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/e560792cfcc09ff52eef424829c580acdce034f9/advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json\",\"id\":\"GHSA-4g86-54fm-h9h8\",\"packages\":[\"Aspire.Dashboard.Sdk.linux-x64\",\"Aspire.Dashboard.Sdk.linux-arm64\",\"Aspire.Dashboard.Sdk.linux-musl-x64\",\"Aspire.Dashboard.Sdk.osx-x64\",\"Aspire.Dashboard.Sdk.osx-arm64\",\"Aspire.Dashboard.Sdk.win-x64\",\"Aspire.Dashboard.Sdk.win-arm64\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-78fc-9688-w8xw\",\"aliases\":[\"CVE-2026-40076\"],\"commit\":\"https://github.com/github/advisory-database/commit/9f28b46ba2ff65d80071fc71d82da7563af77b90\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/9f28b46ba2ff65d80071fc71d82da7563af77b90/advisories/github-reviewed/2026/05/GHSA-78fc-9688-w8xw/GHSA-78fc-9688-w8xw.json\",\"id\":\"GHSA-78fc-9688-w8xw\",\"packages\":[\"org.openmrs.web:openmrs-web\"],\"path\":\"advisories/github-reviewed/2026/05/GHSA-78fc-9688-w8xw/GHSA-78fc-9688-w8xw.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)\"},{\"advisory\":\"https://github.com/advisories/GHSA-w6c6-c85g-mmv6\",\"aliases\":[\"CVE-2026-39395\"],\"commit\":\"https://github.com/github/advisory-database/commit/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json\",\"id\":\"GHSA-w6c6-c85g-mmv6\",\"packages\":[\"github.com/sigstore/cosign/v3\",\"github.com/sigstore/cosign/v2\",\"github.com/sigstore/cosign\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Cosign's verify-blob-attestation reports false positive when payload parsing fails\"},{\"advisory\":\"https://github.com/advisories/GHSA-h24v-f482-8cwf\",\"aliases\":[\"CVE-2026-84974\"],\"commit\":\"https://github.com/github/advisory-database/commit/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3/advisories/github-reviewed/2026/11/GHSA-h24v-f482-8cwf/GHSA-h24v-f482-8cwf.json\",\"id\":\"GHSA-h24v-f482-8cwf\",\"packages\":[\"code16/sharp\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-h24v-f482-8cwf/GHSA-h24v-f482-8cwf.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"code16/sharp: Arbitrary class instantiation through the embed_key API parameter\"},{\"advisory\":\"https://github.com/advisories/GHSA-g6f8-c3x9-jv7f\",\"aliases\":[\"CVE-2026-84987\"],\"commit\":\"https://github.com/github/advisory-database/commit/e61a46f83a276df0341911ca65d78dbc586d835b\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/e61a46f83a276df0341911ca65d78dbc586d835b/advisories/github-reviewed/2026/11/GHSA-g6f8-c3x9-jv7f/GHSA-g6f8-c3x9-jv7f.json\",\"id\":\"GHSA-g6f8-c3x9-jv7f\",\"packages\":[\"code16/sharp\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-g6f8-c3x9-jv7f/GHSA-g6f8-c3x9-jv7f.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check\"},{\"advisory\":\"https://github.com/advisories/GHSA-7m8x-x364-m26j\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/1ba2ca7797bbafb4c6002831da11ba970806c7bc\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/1ba2ca7797bbafb4c6002831da11ba970806c7bc/advisories/github-reviewed/2026/11/GHSA-7m8x-x364-m26j/GHSA-7m8x-x364-m26j.json\",\"id\":\"GHSA-7m8x-x364-m26j\",\"packages\":[\"signalk-server\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-7m8x-x364-m26j/GHSA-7m8x-x364-m26j.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients\"},{\"advisory\":\"https://github.com/advisories/GHSA-8835-xmqj-354h\",\"aliases\":[\"CVE-2026-125328\"],\"commit\":\"https://github.com/github/advisory-database/commit/567191a5afcc1a3209e981a95a5ef7181e63938c\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/567191a5afcc1a3209e981a95a5ef7181e63938c/advisories/github-reviewed/2026/11/GHSA-8835-xmqj-354h/GHSA-8835-xmqj-354h.json\",\"id\":\"GHSA-8835-xmqj-354h\",\"packages\":[\"github.com/pgEdge/pgedge-go-llm-lib\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-8835-xmqj-354h/GHSA-8835-xmqj-354h.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"pgEdge Go LLM Library discloses provider API key fragments in error messages\"},{\"advisory\":\"https://github.com/advisories/GHSA-w437-9mwm-j6vq\",\"aliases\":[\"CVE-2026-125325\"],\"commit\":\"https://github.com/github/advisory-database/commit/7c0bdb0568fbb92ddd8d1e265ca65cfbf51b36b0\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/7c0bdb0568fbb92ddd8d1e265ca65cfbf51b36b0/advisories/github-reviewed/2026/11/GHSA-w437-9mwm-j6vq/GHSA-w437-9mwm-j6vq.json\",\"id\":\"GHSA-w437-9mwm-j6vq\",\"packages\":[\"github.com/pgEdge/pgedge-rag-server\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-w437-9mwm-j6vq/GHSA-w437-9mwm-j6vq.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests\"},{\"advisory\":\"https://github.com/advisories/GHSA-68g8-gh8f-7rhg\",\"aliases\":[\"CVE-2026-125326\"],\"commit\":\"https://github.com/github/advisory-database/commit/b22a4f89d856aa93f55361580b8566965ca40627\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/b22a4f89d856aa93f55361580b8566965ca40627/advisories/github-reviewed/2026/11/GHSA-68g8-gh8f-7rhg/GHSA-68g8-gh8f-7rhg.json\",\"id\":\"GHSA-68g8-gh8f-7rhg\",\"packages\":[\"github.com/pgEdge/pgedge-rag-server\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-68g8-gh8f-7rhg/GHSA-68g8-gh8f-7rhg.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"pgEdge RAG Server discloses part of the configured provider credential through API error messages\"},{\"advisory\":\"https://github.com/advisories/GHSA-5qg5-rgp6-j5m5\",\"aliases\":[\"CVE-2026-125327\"],\"commit\":\"https://github.com/github/advisory-database/commit/a2c46f7aa4da77e6a91f1068f35f3f7652d20226\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/a2c46f7aa4da77e6a91f1068f35f3f7652d20226/advisories/github-reviewed/2026/11/GHSA-5qg5-rgp6-j5m5/GHSA-5qg5-rgp6-j5m5.json\",\"id\":\"GHSA-5qg5-rgp6-j5m5\",\"packages\":[\"github.com/pgEdge/pgedge-rag-server\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-5qg5-rgp6-j5m5/GHSA-5qg5-rgp6-j5m5.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests\"},{\"advisory\":\"https://github.com/advisories/GHSA-vq9p-w6wv-cr25\",\"aliases\":[\"CVE-2026-125323\"],\"commit\":\"https://github.com/github/advisory-database/commit/4c4c219d1d1228122362cd686af326429f8cb05d\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/4c4c219d1d1228122362cd686af326429f8cb05d/advisories/github-reviewed/2026/11/GHSA-vq9p-w6wv-cr25/GHSA-vq9p-w6wv-cr25.json\",\"id\":\"GHSA-vq9p-w6wv-cr25\",\"packages\":[\"github.com/pgEdge/control-plane\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-vq9p-w6wv-cr25/GHSA-vq9p-w6wv-cr25.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections\"},{\"advisory\":\"https://github.com/advisories/GHSA-h6v6-rg66-fqj4\",\"aliases\":[\"CVE-2026-126203\"],\"commit\":\"https://github.com/github/advisory-database/commit/4d4116d5150f1278652e17654d4754376576a761\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/4d4116d5150f1278652e17654d4754376576a761/advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json\",\"id\":\"GHSA-h6v6-rg66-fqj4\",\"packages\":[\"loofah\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values\"},{\"advisory\":\"https://github.com/advisories/GHSA-jcff-cj73-4w4f\",\"aliases\":[\"CVE-2026-126206\"],\"commit\":\"https://github.com/github/advisory-database/commit/a480b84910a1e6f0f494ef3a4ec6cae6acd18c70\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/a480b84910a1e6f0f494ef3a4ec6cae6acd18c70/advisories/github-reviewed/2026/11/GHSA-jcff-cj73-4w4f/GHSA-jcff-cj73-4w4f.json\",\"id\":\"GHSA-jcff-cj73-4w4f\",\"packages\":[\"loofah\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-jcff-cj73-4w4f/GHSA-jcff-cj73-4w4f.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Loofah allowed_uri? treats data:text&sol;html as safe text/plain\"},{\"advisory\":\"https://github.com/advisories/GHSA-mf2j-8f84-cc9q\",\"aliases\":[\"CVE-2026-126205\"],\"commit\":\"https://github.com/github/advisory-database/commit/8bab2486d30965fe7aeee7301a0e9734a62bfbdb\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/8bab2486d30965fe7aeee7301a0e9734a62bfbdb/advisories/github-reviewed/2026/11/GHSA-mf2j-8f84-cc9q/GHSA-mf2j-8f84-cc9q.json\",\"id\":\"GHSA-mf2j-8f84-cc9q\",\"packages\":[\"loofah\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-mf2j-8f84-cc9q/GHSA-mf2j-8f84-cc9q.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Loofah: Regular expression denial of service in the SVG local-reference check\"},{\"advisory\":\"https://github.com/advisories/GHSA-m3x9-938q-5767\",\"aliases\":[\"CVE-2026-126207\"],\"commit\":\"https://github.com/github/advisory-database/commit/6129b60c1e199460d2925a7f5e6195fe7e58813c\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/6129b60c1e199460d2925a7f5e6195fe7e58813c/advisories/github-reviewed/2026/11/GHSA-m3x9-938q-5767/GHSA-m3x9-938q-5767.json\",\"id\":\"GHSA-m3x9-938q-5767\",\"packages\":[\"loofah\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-m3x9-938q-5767/GHSA-m3x9-938q-5767.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Loofah: CSS url() sanitization bypass via escaped parentheses\"},{\"advisory\":\"https://github.com/advisories/GHSA-p9wj-w8xq-vjx6\",\"aliases\":[\"CVE-2026-126209\"],\"commit\":\"https://github.com/github/advisory-database/commit/b878b150d18a0f6e5f0bfc8db7e1e3252cbd1357\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/b878b150d18a0f6e5f0bfc8db7e1e3252cbd1357/advisories/github-reviewed/2026/11/GHSA-p9wj-w8xq-vjx6/GHSA-p9wj-w8xq-vjx6.json\",\"id\":\"GHSA-p9wj-w8xq-vjx6\",\"packages\":[\"loofah\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-p9wj-w8xq-vjx6/GHSA-p9wj-w8xq-vjx6.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Loofah allowed_uri? treats javascript&#x3a alert(1) as safe\"},{\"advisory\":\"https://github.com/advisories/GHSA-345x-3rq2-jfrm\",\"aliases\":[\"CVE-2026-126208\"],\"commit\":\"https://github.com/github/advisory-database/commit/c3b271f5334a288082e7b26ba7b441158c572999\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/c3b271f5334a288082e7b26ba7b441158c572999/advisories/github-reviewed/2026/11/GHSA-345x-3rq2-jfrm/GHSA-345x-3rq2-jfrm.json\",\"id\":\"GHSA-345x-3rq2-jfrm\",\"packages\":[\"loofah\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-345x-3rq2-jfrm/GHSA-345x-3rq2-jfrm.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction\"},{\"advisory\":\"https://github.com/advisories/GHSA-jpvv-r467-5p4w\",\"aliases\":[\"CVE-2026-126210\"],\"commit\":\"https://github.com/github/advisory-database/commit/c3b271f5334a288082e7b26ba7b441158c572999\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/c3b271f5334a288082e7b26ba7b441158c572999/advisories/github-reviewed/2026/11/GHSA-jpvv-r467-5p4w/GHSA-jpvv-r467-5p4w.json\",\"id\":\"GHSA-jpvv-r467-5p4w\",\"packages\":[\"@hono/node-server\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-jpvv-r467-5p4w/GHSA-jpvv-r467-5p4w.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy\"},{\"advisory\":\"https://github.com/advisories/GHSA-qv5m-9pm6-hqp3\",\"aliases\":[\"CVE-2026-126343\"],\"commit\":\"https://github.com/github/advisory-database/commit/67a7c7d40b61b59c524a24d21bfca3c4ba011abc\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/67a7c7d40b61b59c524a24d21bfca3c4ba011abc/advisories/github-reviewed/2026/11/GHSA-qv5m-9pm6-hqp3/GHSA-qv5m-9pm6-hqp3.json\",\"id\":\"GHSA-qv5m-9pm6-hqp3\",\"packages\":[\"@hono/node-server\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-qv5m-9pm6-hqp3/GHSA-qv5m-9pm6-hqp3.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process\"},{\"advisory\":\"https://github.com/advisories/GHSA-5pm8-86m8-9m6r\",\"aliases\":[\"CVE-2026-126345\"],\"commit\":\"https://github.com/github/advisory-database/commit/d91c7de936f9443ed9ee032015813e1be870a16b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/d91c7de936f9443ed9ee032015813e1be870a16b/advisories/github-reviewed/2026/11/GHSA-5pm8-86m8-9m6r/GHSA-5pm8-86m8-9m6r.json\",\"id\":\"GHSA-5pm8-86m8-9m6r\",\"packages\":[\"basic-ftp\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-5pm8-86m8-9m6r/GHSA-5pm8-86m8-9m6r.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()\"},{\"advisory\":\"https://github.com/advisories/GHSA-3f4q-8x5m-76v8\",\"aliases\":[\"CVE-2026-126188\"],\"commit\":\"https://github.com/github/advisory-database/commit/2696adc18ddbf0e1edcf6af99b3bc1125c25677c\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/2696adc18ddbf0e1edcf6af99b3bc1125c25677c/advisories/github-reviewed/2026/11/GHSA-3f4q-8x5m-76v8/GHSA-3f4q-8x5m-76v8.json\",\"id\":\"GHSA-3f4q-8x5m-76v8\",\"packages\":[\"activestorage\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-3f4q-8x5m-76v8/GHSA-3f4q-8x5m-76v8.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Active Storage: Possible local file disclosure in video previews and analysis\"},{\"advisory\":\"https://github.com/advisories/GHSA-68p9-83h6-5wpj\",\"aliases\":[\"CVE-2026-126069\"],\"commit\":\"https://github.com/github/advisory-database/commit/71381136d41b61e0a6962e2fe041d7ea16e45e0b\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/71381136d41b61e0a6962e2fe041d7ea16e45e0b/advisories/github-reviewed/2026/11/GHSA-68p9-83h6-5wpj/GHSA-68p9-83h6-5wpj.json\",\"id\":\"GHSA-68p9-83h6-5wpj\",\"packages\":[\"actionview\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-68p9-83h6-5wpj/GHSA-68p9-83h6-5wpj.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Action View: Possible XSS vulnerability in tag helpers\"},{\"advisory\":\"https://github.com/advisories/GHSA-r4jh-29pc-gfqr\",\"aliases\":[\"CVE-2026-126346\"],\"commit\":\"https://github.com/github/advisory-database/commit/01e8968af3d25281248763c5561250b20c02d08c\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/01e8968af3d25281248763c5561250b20c02d08c/advisories/github-reviewed/2026/11/GHSA-r4jh-29pc-gfqr/GHSA-r4jh-29pc-gfqr.json\",\"id\":\"GHSA-r4jh-29pc-gfqr\",\"packages\":[\"basic-ftp\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-r4jh-29pc-gfqr/GHSA-r4jh-29pc-gfqr.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF\"},{\"advisory\":\"https://github.com/advisories/GHSA-8gmh-2hhj-2hv9\",\"aliases\":[\"CVE-2026-126354\"],\"commit\":\"https://github.com/github/advisory-database/commit/1c66f990487abe2b5e691d9f67f9587c3d2bc076\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/1c66f990487abe2b5e691d9f67f9587c3d2bc076/advisories/github-reviewed/2026/11/GHSA-8gmh-2hhj-2hv9/GHSA-8gmh-2hhj-2hv9.json\",\"id\":\"GHSA-8gmh-2hhj-2hv9\",\"packages\":[\"addressable\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-8gmh-2hhj-2hv9/GHSA-8gmh-2hhj-2hv9.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Addressable URI normalization resolves some dotted path segments to the wrong path\"},{\"advisory\":\"https://github.com/advisories/GHSA-9f42-57jx-vpp3\",\"aliases\":[\"CVE-2026-126352\"],\"commit\":\"https://github.com/github/advisory-database/commit/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a/advisories/github-reviewed/2026/11/GHSA-9f42-57jx-vpp3/GHSA-9f42-57jx-vpp3.json\",\"id\":\"GHSA-9f42-57jx-vpp3\",\"packages\":[\"addressable\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-9f42-57jx-vpp3/GHSA-9f42-57jx-vpp3.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Addressable: Regular Expression Denial of Service in templates with multiple variables\"},{\"advisory\":\"https://github.com/advisories/GHSA-j82w-28jv-3pmj\",\"aliases\":[\"CVE-2026-126350\"],\"commit\":\"https://github.com/github/advisory-database/commit/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a/advisories/github-reviewed/2026/11/GHSA-j82w-28jv-3pmj/GHSA-j82w-28jv-3pmj.json\",\"id\":\"GHSA-j82w-28jv-3pmj\",\"packages\":[\"addressable\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-j82w-28jv-3pmj/GHSA-j82w-28jv-3pmj.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Addressable: Regular Expression Denial of Service in templates with certain exploded expressions\"},{\"advisory\":\"https://github.com/advisories/GHSA-f4j9-crrj-867q\",\"aliases\":[\"CVE-2026-126362\"],\"commit\":\"https://github.com/github/advisory-database/commit/00ace44fceb84a0a31512db616bd95a1e75e1735\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/00ace44fceb84a0a31512db616bd95a1e75e1735/advisories/github-reviewed/2026/11/GHSA-f4j9-crrj-867q/GHSA-f4j9-crrj-867q.json\",\"id\":\"GHSA-f4j9-crrj-867q\",\"packages\":[\"@astrojs/svelte\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-f4j9-crrj-867q/GHSA-f4j9-crrj-867q.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Astro: Reflected XSS via unescaped slot names in @astrojs/svelte\"},{\"advisory\":\"https://github.com/advisories/GHSA-jmv2-qgxf-f995\",\"aliases\":[\"CVE-2026-126363\"],\"commit\":\"https://github.com/github/advisory-database/commit/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17/advisories/github-reviewed/2026/11/GHSA-jmv2-qgxf-f995/GHSA-jmv2-qgxf-f995.json\",\"id\":\"GHSA-jmv2-qgxf-f995\",\"packages\":[\"@astrojs/solid-js\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-jmv2-qgxf-f995/GHSA-jmv2-qgxf-f995.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js\"},{\"advisory\":\"https://github.com/advisories/GHSA-qq38-m9mg-xjj5\",\"aliases\":[\"CVE-2026-126351\"],\"commit\":\"https://github.com/github/advisory-database/commit/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17/advisories/github-reviewed/2026/11/GHSA-qq38-m9mg-xjj5/GHSA-qq38-m9mg-xjj5.json\",\"id\":\"GHSA-qq38-m9mg-xjj5\",\"packages\":[\"addressable\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-qq38-m9mg-xjj5/GHSA-qq38-m9mg-xjj5.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Addressable: Denial of service in URI path normalization\"},{\"advisory\":\"https://github.com/advisories/GHSA-22fx-6r9m-r8h9\",\"aliases\":[\"CVE-2023-29659\"],\"commit\":\"https://github.com/github/advisory-database/commit/e205b510dfe7e69e9324b2b3af3028598f3df97c\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/e205b510dfe7e69e9324b2b3af3028598f3df97c/advisories/github-reviewed/2023/05/GHSA-22fx-6r9m-r8h9/GHSA-22fx-6r9m-r8h9.json\",\"id\":\"GHSA-22fx-6r9m-r8h9\",\"packages\":[\"github.com/strukturag/libheif\"],\"path\":\"advisories/github-reviewed/2023/05/GHSA-22fx-6r9m-r8h9/GHSA-22fx-6r9m-r8h9.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"libheif vulnerable to segmentation fault via floating point exception\"},{\"advisory\":\"https://github.com/advisories/GHSA-539f-xcgw-2gjg\",\"aliases\":[\"CVE-2026-126349\"],\"commit\":\"https://github.com/github/advisory-database/commit/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487/advisories/github-reviewed/2026/11/GHSA-539f-xcgw-2gjg/GHSA-539f-xcgw-2gjg.json\",\"id\":\"GHSA-539f-xcgw-2gjg\",\"packages\":[\"addressable\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-539f-xcgw-2gjg/GHSA-539f-xcgw-2gjg.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Addressable display_uri can show misleading hosts containing bidi and invisible characters\"},{\"advisory\":\"https://github.com/advisories/GHSA-9crm-g4mf-wc5j\",\"aliases\":[\"CVE-2026-126348\"],\"commit\":\"https://github.com/github/advisory-database/commit/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487/advisories/github-reviewed/2026/11/GHSA-9crm-g4mf-wc5j/GHSA-9crm-g4mf-wc5j.json\",\"id\":\"GHSA-9crm-g4mf-wc5j\",\"packages\":[\"addressable\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-9crm-g4mf-wc5j/GHSA-9crm-g4mf-wc5j.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Addressable display_uri can show misleading hosts with invalid Punycode A-labels\"},{\"advisory\":\"https://github.com/advisories/GHSA-73v3-wf97-vpgj\",\"aliases\":[\"CVE-2026-126366\"],\"commit\":\"https://github.com/github/advisory-database/commit/3171910415f877765a1635d1c70d7274932baa3f\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/3171910415f877765a1635d1c70d7274932baa3f/advisories/github-reviewed/2026/11/GHSA-73v3-wf97-vpgj/GHSA-73v3-wf97-vpgj.json\",\"id\":\"GHSA-73v3-wf97-vpgj\",\"packages\":[\"msgpack\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-73v3-wf97-vpgj/GHSA-73v3-wf97-vpgj.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM\"},{\"advisory\":\"https://github.com/advisories/GHSA-gg5j-6742-v827\",\"aliases\":[\"CVE-2026-128065\"],\"commit\":\"https://github.com/github/advisory-database/commit/6cb475c27ff368dee6735c8d6fb1fcb883f08a06\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/6cb475c27ff368dee6735c8d6fb1fcb883f08a06/advisories/github-reviewed/2026/11/GHSA-gg5j-6742-v827/GHSA-gg5j-6742-v827.json\",\"id\":\"GHSA-gg5j-6742-v827\",\"packages\":[\"@grpc/grpc-js-xds\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-gg5j-6742-v827/GHSA-gg5j-6742-v827.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied\"},{\"advisory\":\"https://github.com/advisories/GHSA-r7hq-q2xm-6c5m\",\"aliases\":[\"CVE-2026-126367\"],\"commit\":\"https://github.com/github/advisory-database/commit/065329326fcdec6f14d08500418cbcdceb8c6028\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/065329326fcdec6f14d08500418cbcdceb8c6028/advisories/github-reviewed/2026/11/GHSA-r7hq-q2xm-6c5m/GHSA-r7hq-q2xm-6c5m.json\",\"id\":\"GHSA-r7hq-q2xm-6c5m\",\"packages\":[\"@grpc/grpc-js-xds\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-r7hq-q2xm-6c5m/GHSA-r7hq-q2xm-6c5m.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation\"},{\"advisory\":\"https://github.com/advisories/GHSA-3gg2-335m-rxc6\",\"aliases\":[\"CVE-2026-126359\"],\"commit\":\"https://github.com/github/advisory-database/commit/1d2ec873ee46d959c071559657664272578a25a3\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/1d2ec873ee46d959c071559657664272578a25a3/advisories/github-reviewed/2026/11/GHSA-3gg2-335m-rxc6/GHSA-3gg2-335m-rxc6.json\",\"id\":\"GHSA-3gg2-335m-rxc6\",\"packages\":[\"hono\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-3gg2-335m-rxc6/GHSA-3gg2-335m-rxc6.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection\"},{\"advisory\":\"https://github.com/advisories/GHSA-4m76-xfj5-7975\",\"aliases\":[\"CVE-2026-126357\"],\"commit\":\"https://github.com/github/advisory-database/commit/1d2ec873ee46d959c071559657664272578a25a3\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/1d2ec873ee46d959c071559657664272578a25a3/advisories/github-reviewed/2026/11/GHSA-4m76-xfj5-7975/GHSA-4m76-xfj5-7975.json\",\"id\":\"GHSA-4m76-xfj5-7975\",\"packages\":[\"hono\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-4m76-xfj5-7975/GHSA-4m76-xfj5-7975.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix\"}],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 12, 2026, GitHub's security advisory list published 49 new advisories, changed 5, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "https://flarereef.flareforward.com/files/watch/d33fc92b80c9cf10b05024e7fb3ee84e6fe879a86abd1f4c9c6ee9e19f45d429.json", "txHash": "0x363e8519d1cf1dc5e9e169b606eeeecad2db189342355934efa33023c53579e7", "receiptUrl": "https://flare-explorer.flare.network/tx/0x363e8519d1cf1dc5e9e169b606eeeecad2db189342355934efa33023c53579e7", "blockNumber": 74402934, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": [], "parsed": {"counts": {"changed": 5, "published": 49, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-12", "kind": "watch-day", "recordedAt": "2026-11-13T02:10:10Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-45c3-73f7-pv4m", "aliases": ["CVE-2026-114605"], "commit": "https://github.com/github/advisory-database/commit/f5be53f06dad97347eec89ab395f4e6028136fcd", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f5be53f06dad97347eec89ab395f4e6028136fcd/advisories/github-reviewed/2026/10/GHSA-45c3-73f7-pv4m/GHSA-45c3-73f7-pv4m.json", "id": "GHSA-45c3-73f7-pv4m", "packages": ["dnspython"], "path": "advisories/github-reviewed/2026/10/GHSA-45c3-73f7-pv4m/GHSA-45c3-73f7-pv4m.json", "severity": "HIGH", "status": "changed", "summary": "dnspython dns.name.from_wire_parser() excessive CPU use"}, {"advisory": "https://github.com/advisories/GHSA-w4f7-4cxr-rv3c", "aliases": ["CVE-2026-43966"], "commit": "https://github.com/github/advisory-database/commit/8907a85b8b570b2cb95b3819d70d2290b29630c7", "ecosystems": ["Hex"], "file": "https://github.com/github/advisory-database/blob/8907a85b8b570b2cb95b3819d70d2290b29630c7/advisories/github-reviewed/2026/06/GHSA-w4f7-4cxr-rv3c/GHSA-w4f7-4cxr-rv3c.json", "id": "GHSA-w4f7-4cxr-rv3c", "packages": ["cowboy", "gun"], "path": "advisories/github-reviewed/2026/06/GHSA-w4f7-4cxr-rv3c/GHSA-w4f7-4cxr-rv3c.json", "severity": "MODERATE", "status": "changed", "summary": "cowboy and gun affected by an HTTP Request/Response Splitting vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-2f3w-v7f5-vpgx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/f0849a6e194453b260479b27b5926cba75c63e18", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/f0849a6e194453b260479b27b5926cba75c63e18/advisories/github-reviewed/2026/11/GHSA-2f3w-v7f5-vpgx/GHSA-2f3w-v7f5-vpgx.json", "id": "GHSA-2f3w-v7f5-vpgx", "packages": ["Aspire.Dashboard.Sdk.linux-x64"], "path": "advisories/github-reviewed/2026/11/GHSA-2f3w-v7f5-vpgx/GHSA-2f3w-v7f5-vpgx.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-4g86-54fm-h9h8", "aliases": ["CVE-2026-118740"], "commit": "https://github.com/github/advisory-database/commit/e560792cfcc09ff52eef424829c580acdce034f9", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/e560792cfcc09ff52eef424829c580acdce034f9/advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json", "id": "GHSA-4g86-54fm-h9h8", "packages": ["Aspire.Dashboard.Sdk.linux-x64", "Aspire.Dashboard.Sdk.linux-arm64", "Aspire.Dashboard.Sdk.linux-musl-x64", "Aspire.Dashboard.Sdk.osx-x64", "Aspire.Dashboard.Sdk.osx-arm64", "Aspire.Dashboard.Sdk.win-x64", "Aspire.Dashboard.Sdk.win-arm64"], "path": "advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json", "severity": "CRITICAL", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-78fc-9688-w8xw", "aliases": ["CVE-2026-40076"], "commit": "https://github.com/github/advisory-database/commit/9f28b46ba2ff65d80071fc71d82da7563af77b90", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/9f28b46ba2ff65d80071fc71d82da7563af77b90/advisories/github-reviewed/2026/05/GHSA-78fc-9688-w8xw/GHSA-78fc-9688-w8xw.json", "id": "GHSA-78fc-9688-w8xw", "packages": ["org.openmrs.web:openmrs-web"], "path": "advisories/github-reviewed/2026/05/GHSA-78fc-9688-w8xw/GHSA-78fc-9688-w8xw.json", "severity": "CRITICAL", "status": "changed", "summary": "OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)"}, {"advisory": "https://github.com/advisories/GHSA-w6c6-c85g-mmv6", "aliases": ["CVE-2026-39395"], "commit": "https://github.com/github/advisory-database/commit/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json", "id": "GHSA-w6c6-c85g-mmv6", "packages": ["github.com/sigstore/cosign/v3", "github.com/sigstore/cosign/v2", "github.com/sigstore/cosign"], "path": "advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json", "severity": "MODERATE", "status": "changed", "summary": "Cosign's verify-blob-attestation reports false positive when payload parsing fails"}, {"advisory": "https://github.com/advisories/GHSA-h24v-f482-8cwf", "aliases": ["CVE-2026-84974"], "commit": "https://github.com/github/advisory-database/commit/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3/advisories/github-reviewed/2026/11/GHSA-h24v-f482-8cwf/GHSA-h24v-f482-8cwf.json", "id": "GHSA-h24v-f482-8cwf", "packages": ["code16/sharp"], "path": "advisories/github-reviewed/2026/11/GHSA-h24v-f482-8cwf/GHSA-h24v-f482-8cwf.json", "severity": "MODERATE", "status": "published", "summary": "code16/sharp: Arbitrary class instantiation through the embed_key API parameter"}, {"advisory": "https://github.com/advisories/GHSA-g6f8-c3x9-jv7f", "aliases": ["CVE-2026-84987"], "commit": "https://github.com/github/advisory-database/commit/e61a46f83a276df0341911ca65d78dbc586d835b", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/e61a46f83a276df0341911ca65d78dbc586d835b/advisories/github-reviewed/2026/11/GHSA-g6f8-c3x9-jv7f/GHSA-g6f8-c3x9-jv7f.json", "id": "GHSA-g6f8-c3x9-jv7f", "packages": ["code16/sharp"], "path": "advisories/github-reviewed/2026/11/GHSA-g6f8-c3x9-jv7f/GHSA-g6f8-c3x9-jv7f.json", "severity": "MODERATE", "status": "published", "summary": "code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check"}, {"advisory": "https://github.com/advisories/GHSA-7m8x-x364-m26j", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/1ba2ca7797bbafb4c6002831da11ba970806c7bc", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1ba2ca7797bbafb4c6002831da11ba970806c7bc/advisories/github-reviewed/2026/11/GHSA-7m8x-x364-m26j/GHSA-7m8x-x364-m26j.json", "id": "GHSA-7m8x-x364-m26j", "packages": ["signalk-server"], "path": "advisories/github-reviewed/2026/11/GHSA-7m8x-x364-m26j/GHSA-7m8x-x364-m26j.json", "severity": "MODERATE", "status": "published", "summary": "Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients"}, {"advisory": "https://github.com/advisories/GHSA-8835-xmqj-354h", "aliases": ["CVE-2026-125328"], "commit": "https://github.com/github/advisory-database/commit/567191a5afcc1a3209e981a95a5ef7181e63938c", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/567191a5afcc1a3209e981a95a5ef7181e63938c/advisories/github-reviewed/2026/11/GHSA-8835-xmqj-354h/GHSA-8835-xmqj-354h.json", "id": "GHSA-8835-xmqj-354h", "packages": ["github.com/pgEdge/pgedge-go-llm-lib"], "path": "advisories/github-reviewed/2026/11/GHSA-8835-xmqj-354h/GHSA-8835-xmqj-354h.json", "severity": "MODERATE", "status": "published", "summary": "pgEdge Go LLM Library discloses provider API key fragments in error messages"}, {"advisory": "https://github.com/advisories/GHSA-w437-9mwm-j6vq", "aliases": ["CVE-2026-125325"], "commit": "https://github.com/github/advisory-database/commit/7c0bdb0568fbb92ddd8d1e265ca65cfbf51b36b0", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/7c0bdb0568fbb92ddd8d1e265ca65cfbf51b36b0/advisories/github-reviewed/2026/11/GHSA-w437-9mwm-j6vq/GHSA-w437-9mwm-j6vq.json", "id": "GHSA-w437-9mwm-j6vq", "packages": ["github.com/pgEdge/pgedge-rag-server"], "path": "advisories/github-reviewed/2026/11/GHSA-w437-9mwm-j6vq/GHSA-w437-9mwm-j6vq.json", "severity": "MODERATE", "status": "published", "summary": "pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests"}, {"advisory": "https://github.com/advisories/GHSA-68g8-gh8f-7rhg", "aliases": ["CVE-2026-125326"], "commit": "https://github.com/github/advisory-database/commit/b22a4f89d856aa93f55361580b8566965ca40627", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/b22a4f89d856aa93f55361580b8566965ca40627/advisories/github-reviewed/2026/11/GHSA-68g8-gh8f-7rhg/GHSA-68g8-gh8f-7rhg.json", "id": "GHSA-68g8-gh8f-7rhg", "packages": ["github.com/pgEdge/pgedge-rag-server"], "path": "advisories/github-reviewed/2026/11/GHSA-68g8-gh8f-7rhg/GHSA-68g8-gh8f-7rhg.json", "severity": "MODERATE", "status": "published", "summary": "pgEdge RAG Server discloses part of the configured provider credential through API error messages"}, {"advisory": "https://github.com/advisories/GHSA-5qg5-rgp6-j5m5", "aliases": ["CVE-2026-125327"], "commit": "https://github.com/github/advisory-database/commit/a2c46f7aa4da77e6a91f1068f35f3f7652d20226", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/a2c46f7aa4da77e6a91f1068f35f3f7652d20226/advisories/github-reviewed/2026/11/GHSA-5qg5-rgp6-j5m5/GHSA-5qg5-rgp6-j5m5.json", "id": "GHSA-5qg5-rgp6-j5m5", "packages": ["github.com/pgEdge/pgedge-rag-server"], "path": "advisories/github-reviewed/2026/11/GHSA-5qg5-rgp6-j5m5/GHSA-5qg5-rgp6-j5m5.json", "severity": "HIGH", "status": "published", "summary": "pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests"}, {"advisory": "https://github.com/advisories/GHSA-vq9p-w6wv-cr25", "aliases": ["CVE-2026-125323"], "commit": "https://github.com/github/advisory-database/commit/4c4c219d1d1228122362cd686af326429f8cb05d", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4c4c219d1d1228122362cd686af326429f8cb05d/advisories/github-reviewed/2026/11/GHSA-vq9p-w6wv-cr25/GHSA-vq9p-w6wv-cr25.json", "id": "GHSA-vq9p-w6wv-cr25", "packages": ["github.com/pgEdge/control-plane"], "path": "advisories/github-reviewed/2026/11/GHSA-vq9p-w6wv-cr25/GHSA-vq9p-w6wv-cr25.json", "severity": "HIGH", "status": "published", "summary": "pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections"}, {"advisory": "https://github.com/advisories/GHSA-h6v6-rg66-fqj4", "aliases": ["CVE-2026-126203"], "commit": "https://github.com/github/advisory-database/commit/4d4116d5150f1278652e17654d4754376576a761", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/4d4116d5150f1278652e17654d4754376576a761/advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json", "id": "GHSA-h6v6-rg66-fqj4", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json", "severity": "MODERATE", "status": "published", "summary": "Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values"}, {"advisory": "https://github.com/advisories/GHSA-jcff-cj73-4w4f", "aliases": ["CVE-2026-126206"], "commit": "https://github.com/github/advisory-database/commit/a480b84910a1e6f0f494ef3a4ec6cae6acd18c70", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/a480b84910a1e6f0f494ef3a4ec6cae6acd18c70/advisories/github-reviewed/2026/11/GHSA-jcff-cj73-4w4f/GHSA-jcff-cj73-4w4f.json", "id": "GHSA-jcff-cj73-4w4f", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-jcff-cj73-4w4f/GHSA-jcff-cj73-4w4f.json", "severity": "MODERATE", "status": "published", "summary": "Loofah allowed_uri? treats data:text&sol;html as safe text/plain"}, {"advisory": "https://github.com/advisories/GHSA-mf2j-8f84-cc9q", "aliases": ["CVE-2026-126205"], "commit": "https://github.com/github/advisory-database/commit/8bab2486d30965fe7aeee7301a0e9734a62bfbdb", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/8bab2486d30965fe7aeee7301a0e9734a62bfbdb/advisories/github-reviewed/2026/11/GHSA-mf2j-8f84-cc9q/GHSA-mf2j-8f84-cc9q.json", "id": "GHSA-mf2j-8f84-cc9q", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-mf2j-8f84-cc9q/GHSA-mf2j-8f84-cc9q.json", "severity": "MODERATE", "status": "published", "summary": "Loofah: Regular expression denial of service in the SVG local-reference check"}, {"advisory": "https://github.com/advisories/GHSA-m3x9-938q-5767", "aliases": ["CVE-2026-126207"], "commit": "https://github.com/github/advisory-database/commit/6129b60c1e199460d2925a7f5e6195fe7e58813c", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/6129b60c1e199460d2925a7f5e6195fe7e58813c/advisories/github-reviewed/2026/11/GHSA-m3x9-938q-5767/GHSA-m3x9-938q-5767.json", "id": "GHSA-m3x9-938q-5767", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-m3x9-938q-5767/GHSA-m3x9-938q-5767.json", "severity": "MODERATE", "status": "published", "summary": "Loofah: CSS url() sanitization bypass via escaped parentheses"}, {"advisory": "https://github.com/advisories/GHSA-p9wj-w8xq-vjx6", "aliases": ["CVE-2026-126209"], "commit": "https://github.com/github/advisory-database/commit/b878b150d18a0f6e5f0bfc8db7e1e3252cbd1357", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/b878b150d18a0f6e5f0bfc8db7e1e3252cbd1357/advisories/github-reviewed/2026/11/GHSA-p9wj-w8xq-vjx6/GHSA-p9wj-w8xq-vjx6.json", "id": "GHSA-p9wj-w8xq-vjx6", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-p9wj-w8xq-vjx6/GHSA-p9wj-w8xq-vjx6.json", "severity": "MODERATE", "status": "published", "summary": "Loofah allowed_uri? treats javascript&#x3a alert(1) as safe"}, {"advisory": "https://github.com/advisories/GHSA-345x-3rq2-jfrm", "aliases": ["CVE-2026-126208"], "commit": "https://github.com/github/advisory-database/commit/c3b271f5334a288082e7b26ba7b441158c572999", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/c3b271f5334a288082e7b26ba7b441158c572999/advisories/github-reviewed/2026/11/GHSA-345x-3rq2-jfrm/GHSA-345x-3rq2-jfrm.json", "id": "GHSA-345x-3rq2-jfrm", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-345x-3rq2-jfrm/GHSA-345x-3rq2-jfrm.json", "severity": "MODERATE", "status": "published", "summary": "Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction"}, {"advisory": "https://github.com/advisories/GHSA-jpvv-r467-5p4w", "aliases": ["CVE-2026-126210"], "commit": "https://github.com/github/advisory-database/commit/c3b271f5334a288082e7b26ba7b441158c572999", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/c3b271f5334a288082e7b26ba7b441158c572999/advisories/github-reviewed/2026/11/GHSA-jpvv-r467-5p4w/GHSA-jpvv-r467-5p4w.json", "id": "GHSA-jpvv-r467-5p4w", "packages": ["@hono/node-server"], "path": "advisories/github-reviewed/2026/11/GHSA-jpvv-r467-5p4w/GHSA-jpvv-r467-5p4w.json", "severity": "MODERATE", "status": "published", "summary": "@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy"}, {"advisory": "https://github.com/advisories/GHSA-qv5m-9pm6-hqp3", "aliases": ["CVE-2026-126343"], "commit": "https://github.com/github/advisory-database/commit/67a7c7d40b61b59c524a24d21bfca3c4ba011abc", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/67a7c7d40b61b59c524a24d21bfca3c4ba011abc/advisories/github-reviewed/2026/11/GHSA-qv5m-9pm6-hqp3/GHSA-qv5m-9pm6-hqp3.json", "id": "GHSA-qv5m-9pm6-hqp3", "packages": ["@hono/node-server"], "path": "advisories/github-reviewed/2026/11/GHSA-qv5m-9pm6-hqp3/GHSA-qv5m-9pm6-hqp3.json", "severity": "MODERATE", "status": "published", "summary": "@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process"}, {"advisory": "https://github.com/advisories/GHSA-5pm8-86m8-9m6r", "aliases": ["CVE-2026-126345"], "commit": "https://github.com/github/advisory-database/commit/d91c7de936f9443ed9ee032015813e1be870a16b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/d91c7de936f9443ed9ee032015813e1be870a16b/advisories/github-reviewed/2026/11/GHSA-5pm8-86m8-9m6r/GHSA-5pm8-86m8-9m6r.json", "id": "GHSA-5pm8-86m8-9m6r", "packages": ["basic-ftp"], "path": "advisories/github-reviewed/2026/11/GHSA-5pm8-86m8-9m6r/GHSA-5pm8-86m8-9m6r.json", "severity": "MODERATE", "status": "published", "summary": "basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()"}, {"advisory": "https://github.com/advisories/GHSA-3f4q-8x5m-76v8", "aliases": ["CVE-2026-126188"], "commit": "https://github.com/github/advisory-database/commit/2696adc18ddbf0e1edcf6af99b3bc1125c25677c", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/2696adc18ddbf0e1edcf6af99b3bc1125c25677c/advisories/github-reviewed/2026/11/GHSA-3f4q-8x5m-76v8/GHSA-3f4q-8x5m-76v8.json", "id": "GHSA-3f4q-8x5m-76v8", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-3f4q-8x5m-76v8/GHSA-3f4q-8x5m-76v8.json", "severity": "LOW", "status": "published", "summary": "Active Storage: Possible local file disclosure in video previews and analysis"}, {"advisory": "https://github.com/advisories/GHSA-68p9-83h6-5wpj", "aliases": ["CVE-2026-126069"], "commit": "https://github.com/github/advisory-database/commit/71381136d41b61e0a6962e2fe041d7ea16e45e0b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/71381136d41b61e0a6962e2fe041d7ea16e45e0b/advisories/github-reviewed/2026/11/GHSA-68p9-83h6-5wpj/GHSA-68p9-83h6-5wpj.json", "id": "GHSA-68p9-83h6-5wpj", "packages": ["actionview"], "path": "advisories/github-reviewed/2026/11/GHSA-68p9-83h6-5wpj/GHSA-68p9-83h6-5wpj.json", "severity": "MODERATE", "status": "published", "summary": "Action View: Possible XSS vulnerability in tag helpers"}, {"advisory": "https://github.com/advisories/GHSA-r4jh-29pc-gfqr", "aliases": ["CVE-2026-126346"], "commit": "https://github.com/github/advisory-database/commit/01e8968af3d25281248763c5561250b20c02d08c", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/01e8968af3d25281248763c5561250b20c02d08c/advisories/github-reviewed/2026/11/GHSA-r4jh-29pc-gfqr/GHSA-r4jh-29pc-gfqr.json", "id": "GHSA-r4jh-29pc-gfqr", "packages": ["basic-ftp"], "path": "advisories/github-reviewed/2026/11/GHSA-r4jh-29pc-gfqr/GHSA-r4jh-29pc-gfqr.json", "severity": "MODERATE", "status": "published", "summary": "basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF"}, {"advisory": "https://github.com/advisories/GHSA-8gmh-2hhj-2hv9", "aliases": ["CVE-2026-126354"], "commit": "https://github.com/github/advisory-database/commit/1c66f990487abe2b5e691d9f67f9587c3d2bc076", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/1c66f990487abe2b5e691d9f67f9587c3d2bc076/advisories/github-reviewed/2026/11/GHSA-8gmh-2hhj-2hv9/GHSA-8gmh-2hhj-2hv9.json", "id": "GHSA-8gmh-2hhj-2hv9", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-8gmh-2hhj-2hv9/GHSA-8gmh-2hhj-2hv9.json", "severity": "MODERATE", "status": "published", "summary": "Addressable URI normalization resolves some dotted path segments to the wrong path"}, {"advisory": "https://github.com/advisories/GHSA-9f42-57jx-vpp3", "aliases": ["CVE-2026-126352"], "commit": "https://github.com/github/advisory-database/commit/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a/advisories/github-reviewed/2026/11/GHSA-9f42-57jx-vpp3/GHSA-9f42-57jx-vpp3.json", "id": "GHSA-9f42-57jx-vpp3", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-9f42-57jx-vpp3/GHSA-9f42-57jx-vpp3.json", "severity": "MODERATE", "status": "published", "summary": "Addressable: Regular Expression Denial of Service in templates with multiple variables"}, {"advisory": "https://github.com/advisories/GHSA-j82w-28jv-3pmj", "aliases": ["CVE-2026-126350"], "commit": "https://github.com/github/advisory-database/commit/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a/advisories/github-reviewed/2026/11/GHSA-j82w-28jv-3pmj/GHSA-j82w-28jv-3pmj.json", "id": "GHSA-j82w-28jv-3pmj", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-j82w-28jv-3pmj/GHSA-j82w-28jv-3pmj.json", "severity": "MODERATE", "status": "published", "summary": "Addressable: Regular Expression Denial of Service in templates with certain exploded expressions"}, {"advisory": "https://github.com/advisories/GHSA-f4j9-crrj-867q", "aliases": ["CVE-2026-126362"], "commit": "https://github.com/github/advisory-database/commit/00ace44fceb84a0a31512db616bd95a1e75e1735", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/00ace44fceb84a0a31512db616bd95a1e75e1735/advisories/github-reviewed/2026/11/GHSA-f4j9-crrj-867q/GHSA-f4j9-crrj-867q.json", "id": "GHSA-f4j9-crrj-867q", "packages": ["@astrojs/svelte"], "path": "advisories/github-reviewed/2026/11/GHSA-f4j9-crrj-867q/GHSA-f4j9-crrj-867q.json", "severity": "LOW", "status": "published", "summary": "Astro: Reflected XSS via unescaped slot names in @astrojs/svelte"}, {"advisory": "https://github.com/advisories/GHSA-jmv2-qgxf-f995", "aliases": ["CVE-2026-126363"], "commit": "https://github.com/github/advisory-database/commit/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17/advisories/github-reviewed/2026/11/GHSA-jmv2-qgxf-f995/GHSA-jmv2-qgxf-f995.json", "id": "GHSA-jmv2-qgxf-f995", "packages": ["@astrojs/solid-js"], "path": "advisories/github-reviewed/2026/11/GHSA-jmv2-qgxf-f995/GHSA-jmv2-qgxf-f995.json", "severity": "LOW", "status": "published", "summary": "Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js"}, {"advisory": "https://github.com/advisories/GHSA-qq38-m9mg-xjj5", "aliases": ["CVE-2026-126351"], "commit": "https://github.com/github/advisory-database/commit/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17/advisories/github-reviewed/2026/11/GHSA-qq38-m9mg-xjj5/GHSA-qq38-m9mg-xjj5.json", "id": "GHSA-qq38-m9mg-xjj5", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-qq38-m9mg-xjj5/GHSA-qq38-m9mg-xjj5.json", "severity": "MODERATE", "status": "published", "summary": "Addressable: Denial of service in URI path normalization"}, {"advisory": "https://github.com/advisories/GHSA-22fx-6r9m-r8h9", "aliases": ["CVE-2023-29659"], "commit": "https://github.com/github/advisory-database/commit/e205b510dfe7e69e9324b2b3af3028598f3df97c", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/e205b510dfe7e69e9324b2b3af3028598f3df97c/advisories/github-reviewed/2023/05/GHSA-22fx-6r9m-r8h9/GHSA-22fx-6r9m-r8h9.json", "id": "GHSA-22fx-6r9m-r8h9", "packages": ["github.com/strukturag/libheif"], "path": "advisories/github-reviewed/2023/05/GHSA-22fx-6r9m-r8h9/GHSA-22fx-6r9m-r8h9.json", "severity": "MODERATE", "status": "changed", "summary": "libheif vulnerable to segmentation fault via floating point exception"}, {"advisory": "https://github.com/advisories/GHSA-539f-xcgw-2gjg", "aliases": ["CVE-2026-126349"], "commit": "https://github.com/github/advisory-database/commit/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487/advisories/github-reviewed/2026/11/GHSA-539f-xcgw-2gjg/GHSA-539f-xcgw-2gjg.json", "id": "GHSA-539f-xcgw-2gjg", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-539f-xcgw-2gjg/GHSA-539f-xcgw-2gjg.json", "severity": "LOW", "status": "published", "summary": "Addressable display_uri can show misleading hosts containing bidi and invisible characters"}, {"advisory": "https://github.com/advisories/GHSA-9crm-g4mf-wc5j", "aliases": ["CVE-2026-126348"], "commit": "https://github.com/github/advisory-database/commit/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487/advisories/github-reviewed/2026/11/GHSA-9crm-g4mf-wc5j/GHSA-9crm-g4mf-wc5j.json", "id": "GHSA-9crm-g4mf-wc5j", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-9crm-g4mf-wc5j/GHSA-9crm-g4mf-wc5j.json", "severity": "MODERATE", "status": "published", "summary": "Addressable display_uri can show misleading hosts with invalid Punycode A-labels"}, {"advisory": "https://github.com/advisories/GHSA-73v3-wf97-vpgj", "aliases": ["CVE-2026-126366"], "commit": "https://github.com/github/advisory-database/commit/3171910415f877765a1635d1c70d7274932baa3f", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/3171910415f877765a1635d1c70d7274932baa3f/advisories/github-reviewed/2026/11/GHSA-73v3-wf97-vpgj/GHSA-73v3-wf97-vpgj.json", "id": "GHSA-73v3-wf97-vpgj", "packages": ["msgpack"], "path": "advisories/github-reviewed/2026/11/GHSA-73v3-wf97-vpgj/GHSA-73v3-wf97-vpgj.json", "severity": "HIGH", "status": "published", "summary": "msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM"}, {"advisory": "https://github.com/advisories/GHSA-gg5j-6742-v827", "aliases": ["CVE-2026-128065"], "commit": "https://github.com/github/advisory-database/commit/6cb475c27ff368dee6735c8d6fb1fcb883f08a06", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/6cb475c27ff368dee6735c8d6fb1fcb883f08a06/advisories/github-reviewed/2026/11/GHSA-gg5j-6742-v827/GHSA-gg5j-6742-v827.json", "id": "GHSA-gg5j-6742-v827", "packages": ["@grpc/grpc-js-xds"], "path": "advisories/github-reviewed/2026/11/GHSA-gg5j-6742-v827/GHSA-gg5j-6742-v827.json", "severity": "MODERATE", "status": "published", "summary": "@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied"}, {"advisory": "https://github.com/advisories/GHSA-r7hq-q2xm-6c5m", "aliases": ["CVE-2026-126367"], "commit": "https://github.com/github/advisory-database/commit/065329326fcdec6f14d08500418cbcdceb8c6028", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/065329326fcdec6f14d08500418cbcdceb8c6028/advisories/github-reviewed/2026/11/GHSA-r7hq-q2xm-6c5m/GHSA-r7hq-q2xm-6c5m.json", "id": "GHSA-r7hq-q2xm-6c5m", "packages": ["@grpc/grpc-js-xds"], "path": "advisories/github-reviewed/2026/11/GHSA-r7hq-q2xm-6c5m/GHSA-r7hq-q2xm-6c5m.json", "severity": "MODERATE", "status": "published", "summary": "@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation"}, {"advisory": "https://github.com/advisories/GHSA-3gg2-335m-rxc6", "aliases": ["CVE-2026-126359"], "commit": "https://github.com/github/advisory-database/commit/1d2ec873ee46d959c071559657664272578a25a3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1d2ec873ee46d959c071559657664272578a25a3/advisories/github-reviewed/2026/11/GHSA-3gg2-335m-rxc6/GHSA-3gg2-335m-rxc6.json", "id": "GHSA-3gg2-335m-rxc6", "packages": ["hono"], "path": "advisories/github-reviewed/2026/11/GHSA-3gg2-335m-rxc6/GHSA-3gg2-335m-rxc6.json", "severity": "LOW", "status": "published", "summary": "Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection"}, {"advisory": "https://github.com/advisories/GHSA-4m76-xfj5-7975", "aliases": ["CVE-2026-126357"], "commit": "https://github.com/github/advisory-database/commit/1d2ec873ee46d959c071559657664272578a25a3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1d2ec873ee46d959c071559657664272578a25a3/advisories/github-reviewed/2026/11/GHSA-4m76-xfj5-7975/GHSA-4m76-xfj5-7975.json", "id": "GHSA-4m76-xfj5-7975", "packages": ["hono"], "path": "advisories/github-reviewed/2026/11/GHSA-4m76-xfj5-7975/GHSA-4m76-xfj5-7975.json", "severity": "MODERATE", "status": "published", "summary": "Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix"}, {"advisory": "https://github.com/advisories/GHSA-h7mg-cq63-vhpq", "aliases": ["CVE-2026-126358"], "commit": "https://github.com/github/advisory-database/commit/1d2ec873ee46d959c071559657664272578a25a3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1d2ec873ee46d959c071559657664272578a25a3/advisories/github-reviewed/2026/11/GHSA-h7mg-cq63-vhpq/GHSA-h7mg-cq63-vhpq.json", "id": "GHSA-h7mg-cq63-vhpq", "packages": ["hono"], "path": "advisories/github-reviewed/2026/11/GHSA-h7mg-cq63-vhpq/GHSA-h7mg-cq63-vhpq.json", "severity": "MODERATE", "status": "published", "summary": "Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator"}, {"advisory": "https://github.com/advisories/GHSA-4h7h-rv7c-7m2v", "aliases": ["CVE-2026-126356"], "commit": "https://github.com/github/advisory-database/commit/c6aa3a3a300705d4948b4bbfbcf25fdf0cf8a1fb", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/c6aa3a3a300705d4948b4bbfbcf25fdf0cf8a1fb/advisories/github-reviewed/2026/11/GHSA-4h7h-rv7c-7m2v/GHSA-4h7h-rv7c-7m2v.json", "id": "GHSA-4h7h-rv7c-7m2v", "packages": ["hono"], "path": "advisories/github-reviewed/2026/11/GHSA-4h7h-rv7c-7m2v/GHSA-4h7h-rv7c-7m2v.json", "severity": "MODERATE", "status": "published", "summary": "Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters"}, {"advisory": "https://github.com/advisories/GHSA-46wx-v44x-9hh2", "aliases": ["CVE-2026-126355"], "commit": "https://github.com/github/advisory-database/commit/627e9e9022715e52f79f6e4b114edce60db4edf1", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/627e9e9022715e52f79f6e4b114edce60db4edf1/advisories/github-reviewed/2026/11/GHSA-46wx-v44x-9hh2/GHSA-46wx-v44x-9hh2.json", "id": "GHSA-46wx-v44x-9hh2", "packages": ["hono"], "path": "advisories/github-reviewed/2026/11/GHSA-46wx-v44x-9hh2/GHSA-46wx-v44x-9hh2.json", "severity": "MODERATE", "status": "published", "summary": "Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)"}, {"advisory": "https://github.com/advisories/GHSA-3w93-6hmw-whh4", "aliases": ["CVE-2026-126084"], "commit": "https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-3w93-6hmw-whh4/GHSA-3w93-6hmw-whh4.json", "id": "GHSA-3w93-6hmw-whh4", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-3w93-6hmw-whh4/GHSA-3w93-6hmw-whh4.json", "severity": "MODERATE", "status": "published", "summary": "Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control"}, {"advisory": "https://github.com/advisories/GHSA-wm3x-v3qw-4jh3", "aliases": ["CVE-2026-126081"], "commit": "https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-wm3x-v3qw-4jh3/GHSA-wm3x-v3qw-4jh3.json", "id": "GHSA-wm3x-v3qw-4jh3", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-wm3x-v3qw-4jh3/GHSA-wm3x-v3qw-4jh3.json", "severity": "HIGH", "status": "published", "summary": "Action Pack: Possible Strong Parameters Bypass in Parameters#each_key"}, {"advisory": "https://github.com/advisories/GHSA-wqgw-9xfh-qf2g", "aliases": ["CVE-2026-128066"], "commit": "https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-wqgw-9xfh-qf2g/GHSA-wqgw-9xfh-qf2g.json", "id": "GHSA-wqgw-9xfh-qf2g", "packages": ["Pillow"], "path": "advisories/github-reviewed/2026/11/GHSA-wqgw-9xfh-qf2g/GHSA-wqgw-9xfh-qf2g.json", "severity": "MODERATE", "status": "published", "summary": "Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data"}, {"advisory": "https://github.com/advisories/GHSA-xcvg-w56q-r89m", "aliases": ["CVE-2026-128067"], "commit": "https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-xcvg-w56q-r89m/GHSA-xcvg-w56q-r89m.json", "id": "GHSA-xcvg-w56q-r89m", "packages": ["Pillow"], "path": "advisories/github-reviewed/2026/11/GHSA-xcvg-w56q-r89m/GHSA-xcvg-w56q-r89m.json", "severity": "HIGH", "status": "published", "summary": "Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size"}, {"advisory": "https://github.com/advisories/GHSA-2p2f-4rq4-gjwc", "aliases": ["CVE-2026-126079"], "commit": "https://github.com/github/advisory-database/commit/7ac5fec35965b4232c0784cd79ee89b565e06a05", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/7ac5fec35965b4232c0784cd79ee89b565e06a05/advisories/github-reviewed/2026/11/GHSA-2p2f-4rq4-gjwc/GHSA-2p2f-4rq4-gjwc.json", "id": "GHSA-2p2f-4rq4-gjwc", "packages": ["actionview"], "path": "advisories/github-reviewed/2026/11/GHSA-2p2f-4rq4-gjwc/GHSA-2p2f-4rq4-gjwc.json", "severity": "MODERATE", "status": "published", "summary": "Action View: Possible XSS vulnerability in text helpers"}, {"advisory": "https://github.com/advisories/GHSA-rq8q-p985-fjq7", "aliases": ["CVE-2026-126070"], "commit": "https://github.com/github/advisory-database/commit/7ac5fec35965b4232c0784cd79ee89b565e06a05", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/7ac5fec35965b4232c0784cd79ee89b565e06a05/advisories/github-reviewed/2026/11/GHSA-rq8q-p985-fjq7/GHSA-rq8q-p985-fjq7.json", "id": "GHSA-rq8q-p985-fjq7", "packages": ["actionview"], "path": "advisories/github-reviewed/2026/11/GHSA-rq8q-p985-fjq7/GHSA-rq8q-p985-fjq7.json", "severity": "MODERATE", "status": "published", "summary": "Action View: Possible XSS vulnerability in strip_tags"}, {"advisory": "https://github.com/advisories/GHSA-v6rj-xm57-3p59", "aliases": ["CVE-2026-126078"], "commit": "https://github.com/github/advisory-database/commit/7ac5fec35965b4232c0784cd79ee89b565e06a05", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/7ac5fec35965b4232c0784cd79ee89b565e06a05/advisories/github-reviewed/2026/11/GHSA-v6rj-xm57-3p59/GHSA-v6rj-xm57-3p59.json", "id": "GHSA-v6rj-xm57-3p59", "packages": ["actionview"], "path": "advisories/github-reviewed/2026/11/GHSA-v6rj-xm57-3p59/GHSA-v6rj-xm57-3p59.json", "severity": "MODERATE", "status": "published", "summary": "Action View: Possible XSS vulnerability in highlight helper"}, {"advisory": "https://github.com/advisories/GHSA-rwvh-fw6r-pwvp", "aliases": ["CVE-2026-126072"], "commit": "https://github.com/github/advisory-database/commit/89e35a6136da4b6fef645503a1ddcd7ff496f51e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/89e35a6136da4b6fef645503a1ddcd7ff496f51e/advisories/github-reviewed/2026/11/GHSA-rwvh-fw6r-pwvp/GHSA-rwvh-fw6r-pwvp.json", "id": "GHSA-rwvh-fw6r-pwvp", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-rwvh-fw6r-pwvp/GHSA-rwvh-fw6r-pwvp.json", "severity": "MODERATE", "status": "published", "summary": "Action Pack: Possible DoS vulnerability in Action Controller Live streaming"}, {"advisory": "https://github.com/advisories/GHSA-x6mj-8jx9-qhqv", "aliases": ["CVE-2026-126077"], "commit": "https://github.com/github/advisory-database/commit/89e35a6136da4b6fef645503a1ddcd7ff496f51e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/89e35a6136da4b6fef645503a1ddcd7ff496f51e/advisories/github-reviewed/2026/11/GHSA-x6mj-8jx9-qhqv/GHSA-x6mj-8jx9-qhqv.json", "id": "GHSA-x6mj-8jx9-qhqv", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-x6mj-8jx9-qhqv/GHSA-x6mj-8jx9-qhqv.json", "severity": "MODERATE", "status": "published", "summary": "Action Pack: Possible sensitive session information leak in Active Storage proxy mode"}, {"advisory": "https://github.com/advisories/GHSA-f3w6-w445-fwh9", "aliases": ["CVE-2026-122006"], "commit": "https://github.com/github/advisory-database/commit/a0dc66bb031dd931c8f7037f2c2adf1196b064d7", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/a0dc66bb031dd931c8f7037f2c2adf1196b064d7/advisories/github-reviewed/2026/11/GHSA-f3w6-w445-fwh9/GHSA-f3w6-w445-fwh9.json", "id": "GHSA-f3w6-w445-fwh9", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-f3w6-w445-fwh9/GHSA-f3w6-w445-fwh9.json", "severity": "CRITICAL", "status": "published", "summary": "Active Storage: Possible arbitrary file write and read in image analysis"}, {"advisory": "https://github.com/advisories/GHSA-wgv4-95jc-33jm", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/a0dc66bb031dd931c8f7037f2c2adf1196b064d7", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/a0dc66bb031dd931c8f7037f2c2adf1196b064d7/advisories/github-reviewed/2026/11/GHSA-wgv4-95jc-33jm/GHSA-wgv4-95jc-33jm.json", "id": "GHSA-wgv4-95jc-33jm", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-wgv4-95jc-33jm/GHSA-wgv4-95jc-33jm.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory: Active Storage: Possible arbitrary file write and read in Active Storage image analysis"}], "sourceId": "advisories-reviewed", "text": "On November 12, 2026, GitHub's security advisory list published 49 new advisories, changed 5, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 37671, "fingerprint": "d33fc92b80c9cf10b05024e7fb3ee84e6fe879a86abd1f4c9c6ee9e19f45d429", "url": "https://flarereef.flareforward.com/files/watch/d33fc92b80c9cf10b05024e7fb3ee84e6fe879a86abd1f4c9c6ee9e19f45d429.json"}}}, "parsed": {"counts": {"changed": 5, "published": 49, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-12", "kind": "watch-day", "recordedAt": "2026-11-13T02:10:10Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-45c3-73f7-pv4m", "aliases": ["CVE-2026-114605"], "commit": "https://github.com/github/advisory-database/commit/f5be53f06dad97347eec89ab395f4e6028136fcd", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/f5be53f06dad97347eec89ab395f4e6028136fcd/advisories/github-reviewed/2026/10/GHSA-45c3-73f7-pv4m/GHSA-45c3-73f7-pv4m.json", "id": "GHSA-45c3-73f7-pv4m", "packages": ["dnspython"], "path": "advisories/github-reviewed/2026/10/GHSA-45c3-73f7-pv4m/GHSA-45c3-73f7-pv4m.json", "severity": "HIGH", "status": "changed", "summary": "dnspython dns.name.from_wire_parser() excessive CPU use"}, {"advisory": "https://github.com/advisories/GHSA-w4f7-4cxr-rv3c", "aliases": ["CVE-2026-43966"], "commit": "https://github.com/github/advisory-database/commit/8907a85b8b570b2cb95b3819d70d2290b29630c7", "ecosystems": ["Hex"], "file": "https://github.com/github/advisory-database/blob/8907a85b8b570b2cb95b3819d70d2290b29630c7/advisories/github-reviewed/2026/06/GHSA-w4f7-4cxr-rv3c/GHSA-w4f7-4cxr-rv3c.json", "id": "GHSA-w4f7-4cxr-rv3c", "packages": ["cowboy", "gun"], "path": "advisories/github-reviewed/2026/06/GHSA-w4f7-4cxr-rv3c/GHSA-w4f7-4cxr-rv3c.json", "severity": "MODERATE", "status": "changed", "summary": "cowboy and gun affected by an HTTP Request/Response Splitting vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-2f3w-v7f5-vpgx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/f0849a6e194453b260479b27b5926cba75c63e18", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/f0849a6e194453b260479b27b5926cba75c63e18/advisories/github-reviewed/2026/11/GHSA-2f3w-v7f5-vpgx/GHSA-2f3w-v7f5-vpgx.json", "id": "GHSA-2f3w-v7f5-vpgx", "packages": ["Aspire.Dashboard.Sdk.linux-x64"], "path": "advisories/github-reviewed/2026/11/GHSA-2f3w-v7f5-vpgx/GHSA-2f3w-v7f5-vpgx.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory: Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-4g86-54fm-h9h8", "aliases": ["CVE-2026-118740"], "commit": "https://github.com/github/advisory-database/commit/e560792cfcc09ff52eef424829c580acdce034f9", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/e560792cfcc09ff52eef424829c580acdce034f9/advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json", "id": "GHSA-4g86-54fm-h9h8", "packages": ["Aspire.Dashboard.Sdk.linux-x64", "Aspire.Dashboard.Sdk.linux-arm64", "Aspire.Dashboard.Sdk.linux-musl-x64", "Aspire.Dashboard.Sdk.osx-x64", "Aspire.Dashboard.Sdk.osx-arm64", "Aspire.Dashboard.Sdk.win-x64", "Aspire.Dashboard.Sdk.win-arm64"], "path": "advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json", "severity": "CRITICAL", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-78fc-9688-w8xw", "aliases": ["CVE-2026-40076"], "commit": "https://github.com/github/advisory-database/commit/9f28b46ba2ff65d80071fc71d82da7563af77b90", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/9f28b46ba2ff65d80071fc71d82da7563af77b90/advisories/github-reviewed/2026/05/GHSA-78fc-9688-w8xw/GHSA-78fc-9688-w8xw.json", "id": "GHSA-78fc-9688-w8xw", "packages": ["org.openmrs.web:openmrs-web"], "path": "advisories/github-reviewed/2026/05/GHSA-78fc-9688-w8xw/GHSA-78fc-9688-w8xw.json", "severity": "CRITICAL", "status": "changed", "summary": "OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)"}, {"advisory": "https://github.com/advisories/GHSA-w6c6-c85g-mmv6", "aliases": ["CVE-2026-39395"], "commit": "https://github.com/github/advisory-database/commit/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json", "id": "GHSA-w6c6-c85g-mmv6", "packages": ["github.com/sigstore/cosign/v3", "github.com/sigstore/cosign/v2", "github.com/sigstore/cosign"], "path": "advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json", "severity": "MODERATE", "status": "changed", "summary": "Cosign's verify-blob-attestation reports false positive when payload parsing fails"}, {"advisory": "https://github.com/advisories/GHSA-h24v-f482-8cwf", "aliases": ["CVE-2026-84974"], "commit": "https://github.com/github/advisory-database/commit/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3/advisories/github-reviewed/2026/11/GHSA-h24v-f482-8cwf/GHSA-h24v-f482-8cwf.json", "id": "GHSA-h24v-f482-8cwf", "packages": ["code16/sharp"], "path": "advisories/github-reviewed/2026/11/GHSA-h24v-f482-8cwf/GHSA-h24v-f482-8cwf.json", "severity": "MODERATE", "status": "published", "summary": "code16/sharp: Arbitrary class instantiation through the embed_key API parameter"}, {"advisory": "https://github.com/advisories/GHSA-g6f8-c3x9-jv7f", "aliases": ["CVE-2026-84987"], "commit": "https://github.com/github/advisory-database/commit/e61a46f83a276df0341911ca65d78dbc586d835b", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/e61a46f83a276df0341911ca65d78dbc586d835b/advisories/github-reviewed/2026/11/GHSA-g6f8-c3x9-jv7f/GHSA-g6f8-c3x9-jv7f.json", "id": "GHSA-g6f8-c3x9-jv7f", "packages": ["code16/sharp"], "path": "advisories/github-reviewed/2026/11/GHSA-g6f8-c3x9-jv7f/GHSA-g6f8-c3x9-jv7f.json", "severity": "MODERATE", "status": "published", "summary": "code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check"}, {"advisory": "https://github.com/advisories/GHSA-7m8x-x364-m26j", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/1ba2ca7797bbafb4c6002831da11ba970806c7bc", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1ba2ca7797bbafb4c6002831da11ba970806c7bc/advisories/github-reviewed/2026/11/GHSA-7m8x-x364-m26j/GHSA-7m8x-x364-m26j.json", "id": "GHSA-7m8x-x364-m26j", "packages": ["signalk-server"], "path": "advisories/github-reviewed/2026/11/GHSA-7m8x-x364-m26j/GHSA-7m8x-x364-m26j.json", "severity": "MODERATE", "status": "published", "summary": "Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients"}, {"advisory": "https://github.com/advisories/GHSA-8835-xmqj-354h", "aliases": ["CVE-2026-125328"], "commit": "https://github.com/github/advisory-database/commit/567191a5afcc1a3209e981a95a5ef7181e63938c", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/567191a5afcc1a3209e981a95a5ef7181e63938c/advisories/github-reviewed/2026/11/GHSA-8835-xmqj-354h/GHSA-8835-xmqj-354h.json", "id": "GHSA-8835-xmqj-354h", "packages": ["github.com/pgEdge/pgedge-go-llm-lib"], "path": "advisories/github-reviewed/2026/11/GHSA-8835-xmqj-354h/GHSA-8835-xmqj-354h.json", "severity": "MODERATE", "status": "published", "summary": "pgEdge Go LLM Library discloses provider API key fragments in error messages"}, {"advisory": "https://github.com/advisories/GHSA-w437-9mwm-j6vq", "aliases": ["CVE-2026-125325"], "commit": "https://github.com/github/advisory-database/commit/7c0bdb0568fbb92ddd8d1e265ca65cfbf51b36b0", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/7c0bdb0568fbb92ddd8d1e265ca65cfbf51b36b0/advisories/github-reviewed/2026/11/GHSA-w437-9mwm-j6vq/GHSA-w437-9mwm-j6vq.json", "id": "GHSA-w437-9mwm-j6vq", "packages": ["github.com/pgEdge/pgedge-rag-server"], "path": "advisories/github-reviewed/2026/11/GHSA-w437-9mwm-j6vq/GHSA-w437-9mwm-j6vq.json", "severity": "MODERATE", "status": "published", "summary": "pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests"}, {"advisory": "https://github.com/advisories/GHSA-68g8-gh8f-7rhg", "aliases": ["CVE-2026-125326"], "commit": "https://github.com/github/advisory-database/commit/b22a4f89d856aa93f55361580b8566965ca40627", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/b22a4f89d856aa93f55361580b8566965ca40627/advisories/github-reviewed/2026/11/GHSA-68g8-gh8f-7rhg/GHSA-68g8-gh8f-7rhg.json", "id": "GHSA-68g8-gh8f-7rhg", "packages": ["github.com/pgEdge/pgedge-rag-server"], "path": "advisories/github-reviewed/2026/11/GHSA-68g8-gh8f-7rhg/GHSA-68g8-gh8f-7rhg.json", "severity": "MODERATE", "status": "published", "summary": "pgEdge RAG Server discloses part of the configured provider credential through API error messages"}, {"advisory": "https://github.com/advisories/GHSA-5qg5-rgp6-j5m5", "aliases": ["CVE-2026-125327"], "commit": "https://github.com/github/advisory-database/commit/a2c46f7aa4da77e6a91f1068f35f3f7652d20226", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/a2c46f7aa4da77e6a91f1068f35f3f7652d20226/advisories/github-reviewed/2026/11/GHSA-5qg5-rgp6-j5m5/GHSA-5qg5-rgp6-j5m5.json", "id": "GHSA-5qg5-rgp6-j5m5", "packages": ["github.com/pgEdge/pgedge-rag-server"], "path": "advisories/github-reviewed/2026/11/GHSA-5qg5-rgp6-j5m5/GHSA-5qg5-rgp6-j5m5.json", "severity": "HIGH", "status": "published", "summary": "pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests"}, {"advisory": "https://github.com/advisories/GHSA-vq9p-w6wv-cr25", "aliases": ["CVE-2026-125323"], "commit": "https://github.com/github/advisory-database/commit/4c4c219d1d1228122362cd686af326429f8cb05d", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/4c4c219d1d1228122362cd686af326429f8cb05d/advisories/github-reviewed/2026/11/GHSA-vq9p-w6wv-cr25/GHSA-vq9p-w6wv-cr25.json", "id": "GHSA-vq9p-w6wv-cr25", "packages": ["github.com/pgEdge/control-plane"], "path": "advisories/github-reviewed/2026/11/GHSA-vq9p-w6wv-cr25/GHSA-vq9p-w6wv-cr25.json", "severity": "HIGH", "status": "published", "summary": "pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections"}, {"advisory": "https://github.com/advisories/GHSA-h6v6-rg66-fqj4", "aliases": ["CVE-2026-126203"], "commit": "https://github.com/github/advisory-database/commit/4d4116d5150f1278652e17654d4754376576a761", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/4d4116d5150f1278652e17654d4754376576a761/advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json", "id": "GHSA-h6v6-rg66-fqj4", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json", "severity": "MODERATE", "status": "published", "summary": "Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values"}, {"advisory": "https://github.com/advisories/GHSA-jcff-cj73-4w4f", "aliases": ["CVE-2026-126206"], "commit": "https://github.com/github/advisory-database/commit/a480b84910a1e6f0f494ef3a4ec6cae6acd18c70", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/a480b84910a1e6f0f494ef3a4ec6cae6acd18c70/advisories/github-reviewed/2026/11/GHSA-jcff-cj73-4w4f/GHSA-jcff-cj73-4w4f.json", "id": "GHSA-jcff-cj73-4w4f", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-jcff-cj73-4w4f/GHSA-jcff-cj73-4w4f.json", "severity": "MODERATE", "status": "published", "summary": "Loofah allowed_uri? treats data:text&sol;html as safe text/plain"}, {"advisory": "https://github.com/advisories/GHSA-mf2j-8f84-cc9q", "aliases": ["CVE-2026-126205"], "commit": "https://github.com/github/advisory-database/commit/8bab2486d30965fe7aeee7301a0e9734a62bfbdb", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/8bab2486d30965fe7aeee7301a0e9734a62bfbdb/advisories/github-reviewed/2026/11/GHSA-mf2j-8f84-cc9q/GHSA-mf2j-8f84-cc9q.json", "id": "GHSA-mf2j-8f84-cc9q", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-mf2j-8f84-cc9q/GHSA-mf2j-8f84-cc9q.json", "severity": "MODERATE", "status": "published", "summary": "Loofah: Regular expression denial of service in the SVG local-reference check"}, {"advisory": "https://github.com/advisories/GHSA-m3x9-938q-5767", "aliases": ["CVE-2026-126207"], "commit": "https://github.com/github/advisory-database/commit/6129b60c1e199460d2925a7f5e6195fe7e58813c", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/6129b60c1e199460d2925a7f5e6195fe7e58813c/advisories/github-reviewed/2026/11/GHSA-m3x9-938q-5767/GHSA-m3x9-938q-5767.json", "id": "GHSA-m3x9-938q-5767", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-m3x9-938q-5767/GHSA-m3x9-938q-5767.json", "severity": "MODERATE", "status": "published", "summary": "Loofah: CSS url() sanitization bypass via escaped parentheses"}, {"advisory": "https://github.com/advisories/GHSA-p9wj-w8xq-vjx6", "aliases": ["CVE-2026-126209"], "commit": "https://github.com/github/advisory-database/commit/b878b150d18a0f6e5f0bfc8db7e1e3252cbd1357", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/b878b150d18a0f6e5f0bfc8db7e1e3252cbd1357/advisories/github-reviewed/2026/11/GHSA-p9wj-w8xq-vjx6/GHSA-p9wj-w8xq-vjx6.json", "id": "GHSA-p9wj-w8xq-vjx6", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-p9wj-w8xq-vjx6/GHSA-p9wj-w8xq-vjx6.json", "severity": "MODERATE", "status": "published", "summary": "Loofah allowed_uri? treats javascript&#x3a alert(1) as safe"}, {"advisory": "https://github.com/advisories/GHSA-345x-3rq2-jfrm", "aliases": ["CVE-2026-126208"], "commit": "https://github.com/github/advisory-database/commit/c3b271f5334a288082e7b26ba7b441158c572999", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/c3b271f5334a288082e7b26ba7b441158c572999/advisories/github-reviewed/2026/11/GHSA-345x-3rq2-jfrm/GHSA-345x-3rq2-jfrm.json", "id": "GHSA-345x-3rq2-jfrm", "packages": ["loofah"], "path": "advisories/github-reviewed/2026/11/GHSA-345x-3rq2-jfrm/GHSA-345x-3rq2-jfrm.json", "severity": "MODERATE", "status": "published", "summary": "Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction"}, {"advisory": "https://github.com/advisories/GHSA-jpvv-r467-5p4w", "aliases": ["CVE-2026-126210"], "commit": "https://github.com/github/advisory-database/commit/c3b271f5334a288082e7b26ba7b441158c572999", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/c3b271f5334a288082e7b26ba7b441158c572999/advisories/github-reviewed/2026/11/GHSA-jpvv-r467-5p4w/GHSA-jpvv-r467-5p4w.json", "id": "GHSA-jpvv-r467-5p4w", "packages": ["@hono/node-server"], "path": "advisories/github-reviewed/2026/11/GHSA-jpvv-r467-5p4w/GHSA-jpvv-r467-5p4w.json", "severity": "MODERATE", "status": "published", "summary": "@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy"}, {"advisory": "https://github.com/advisories/GHSA-qv5m-9pm6-hqp3", "aliases": ["CVE-2026-126343"], "commit": "https://github.com/github/advisory-database/commit/67a7c7d40b61b59c524a24d21bfca3c4ba011abc", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/67a7c7d40b61b59c524a24d21bfca3c4ba011abc/advisories/github-reviewed/2026/11/GHSA-qv5m-9pm6-hqp3/GHSA-qv5m-9pm6-hqp3.json", "id": "GHSA-qv5m-9pm6-hqp3", "packages": ["@hono/node-server"], "path": "advisories/github-reviewed/2026/11/GHSA-qv5m-9pm6-hqp3/GHSA-qv5m-9pm6-hqp3.json", "severity": "MODERATE", "status": "published", "summary": "@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process"}, {"advisory": "https://github.com/advisories/GHSA-5pm8-86m8-9m6r", "aliases": ["CVE-2026-126345"], "commit": "https://github.com/github/advisory-database/commit/d91c7de936f9443ed9ee032015813e1be870a16b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/d91c7de936f9443ed9ee032015813e1be870a16b/advisories/github-reviewed/2026/11/GHSA-5pm8-86m8-9m6r/GHSA-5pm8-86m8-9m6r.json", "id": "GHSA-5pm8-86m8-9m6r", "packages": ["basic-ftp"], "path": "advisories/github-reviewed/2026/11/GHSA-5pm8-86m8-9m6r/GHSA-5pm8-86m8-9m6r.json", "severity": "MODERATE", "status": "published", "summary": "basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()"}, {"advisory": "https://github.com/advisories/GHSA-3f4q-8x5m-76v8", "aliases": ["CVE-2026-126188"], "commit": "https://github.com/github/advisory-database/commit/2696adc18ddbf0e1edcf6af99b3bc1125c25677c", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/2696adc18ddbf0e1edcf6af99b3bc1125c25677c/advisories/github-reviewed/2026/11/GHSA-3f4q-8x5m-76v8/GHSA-3f4q-8x5m-76v8.json", "id": "GHSA-3f4q-8x5m-76v8", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-3f4q-8x5m-76v8/GHSA-3f4q-8x5m-76v8.json", "severity": "LOW", "status": "published", "summary": "Active Storage: Possible local file disclosure in video previews and analysis"}, {"advisory": "https://github.com/advisories/GHSA-68p9-83h6-5wpj", "aliases": ["CVE-2026-126069"], "commit": "https://github.com/github/advisory-database/commit/71381136d41b61e0a6962e2fe041d7ea16e45e0b", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/71381136d41b61e0a6962e2fe041d7ea16e45e0b/advisories/github-reviewed/2026/11/GHSA-68p9-83h6-5wpj/GHSA-68p9-83h6-5wpj.json", "id": "GHSA-68p9-83h6-5wpj", "packages": ["actionview"], "path": "advisories/github-reviewed/2026/11/GHSA-68p9-83h6-5wpj/GHSA-68p9-83h6-5wpj.json", "severity": "MODERATE", "status": "published", "summary": "Action View: Possible XSS vulnerability in tag helpers"}, {"advisory": "https://github.com/advisories/GHSA-r4jh-29pc-gfqr", "aliases": ["CVE-2026-126346"], "commit": "https://github.com/github/advisory-database/commit/01e8968af3d25281248763c5561250b20c02d08c", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/01e8968af3d25281248763c5561250b20c02d08c/advisories/github-reviewed/2026/11/GHSA-r4jh-29pc-gfqr/GHSA-r4jh-29pc-gfqr.json", "id": "GHSA-r4jh-29pc-gfqr", "packages": ["basic-ftp"], "path": "advisories/github-reviewed/2026/11/GHSA-r4jh-29pc-gfqr/GHSA-r4jh-29pc-gfqr.json", "severity": "MODERATE", "status": "published", "summary": "basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF"}, {"advisory": "https://github.com/advisories/GHSA-8gmh-2hhj-2hv9", "aliases": ["CVE-2026-126354"], "commit": "https://github.com/github/advisory-database/commit/1c66f990487abe2b5e691d9f67f9587c3d2bc076", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/1c66f990487abe2b5e691d9f67f9587c3d2bc076/advisories/github-reviewed/2026/11/GHSA-8gmh-2hhj-2hv9/GHSA-8gmh-2hhj-2hv9.json", "id": "GHSA-8gmh-2hhj-2hv9", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-8gmh-2hhj-2hv9/GHSA-8gmh-2hhj-2hv9.json", "severity": "MODERATE", "status": "published", "summary": "Addressable URI normalization resolves some dotted path segments to the wrong path"}, {"advisory": "https://github.com/advisories/GHSA-9f42-57jx-vpp3", "aliases": ["CVE-2026-126352"], "commit": "https://github.com/github/advisory-database/commit/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a/advisories/github-reviewed/2026/11/GHSA-9f42-57jx-vpp3/GHSA-9f42-57jx-vpp3.json", "id": "GHSA-9f42-57jx-vpp3", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-9f42-57jx-vpp3/GHSA-9f42-57jx-vpp3.json", "severity": "MODERATE", "status": "published", "summary": "Addressable: Regular Expression Denial of Service in templates with multiple variables"}, {"advisory": "https://github.com/advisories/GHSA-j82w-28jv-3pmj", "aliases": ["CVE-2026-126350"], "commit": "https://github.com/github/advisory-database/commit/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a/advisories/github-reviewed/2026/11/GHSA-j82w-28jv-3pmj/GHSA-j82w-28jv-3pmj.json", "id": "GHSA-j82w-28jv-3pmj", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-j82w-28jv-3pmj/GHSA-j82w-28jv-3pmj.json", "severity": "MODERATE", "status": "published", "summary": "Addressable: Regular Expression Denial of Service in templates with certain exploded expressions"}, {"advisory": "https://github.com/advisories/GHSA-f4j9-crrj-867q", "aliases": ["CVE-2026-126362"], "commit": "https://github.com/github/advisory-database/commit/00ace44fceb84a0a31512db616bd95a1e75e1735", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/00ace44fceb84a0a31512db616bd95a1e75e1735/advisories/github-reviewed/2026/11/GHSA-f4j9-crrj-867q/GHSA-f4j9-crrj-867q.json", "id": "GHSA-f4j9-crrj-867q", "packages": ["@astrojs/svelte"], "path": "advisories/github-reviewed/2026/11/GHSA-f4j9-crrj-867q/GHSA-f4j9-crrj-867q.json", "severity": "LOW", "status": "published", "summary": "Astro: Reflected XSS via unescaped slot names in @astrojs/svelte"}, {"advisory": "https://github.com/advisories/GHSA-jmv2-qgxf-f995", "aliases": ["CVE-2026-126363"], "commit": "https://github.com/github/advisory-database/commit/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17/advisories/github-reviewed/2026/11/GHSA-jmv2-qgxf-f995/GHSA-jmv2-qgxf-f995.json", "id": "GHSA-jmv2-qgxf-f995", "packages": ["@astrojs/solid-js"], "path": "advisories/github-reviewed/2026/11/GHSA-jmv2-qgxf-f995/GHSA-jmv2-qgxf-f995.json", "severity": "LOW", "status": "published", "summary": "Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js"}, {"advisory": "https://github.com/advisories/GHSA-qq38-m9mg-xjj5", "aliases": ["CVE-2026-126351"], "commit": "https://github.com/github/advisory-database/commit/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17/advisories/github-reviewed/2026/11/GHSA-qq38-m9mg-xjj5/GHSA-qq38-m9mg-xjj5.json", "id": "GHSA-qq38-m9mg-xjj5", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-qq38-m9mg-xjj5/GHSA-qq38-m9mg-xjj5.json", "severity": "MODERATE", "status": "published", "summary": "Addressable: Denial of service in URI path normalization"}, {"advisory": "https://github.com/advisories/GHSA-22fx-6r9m-r8h9", "aliases": ["CVE-2023-29659"], "commit": "https://github.com/github/advisory-database/commit/e205b510dfe7e69e9324b2b3af3028598f3df97c", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/e205b510dfe7e69e9324b2b3af3028598f3df97c/advisories/github-reviewed/2023/05/GHSA-22fx-6r9m-r8h9/GHSA-22fx-6r9m-r8h9.json", "id": "GHSA-22fx-6r9m-r8h9", "packages": ["github.com/strukturag/libheif"], "path": "advisories/github-reviewed/2023/05/GHSA-22fx-6r9m-r8h9/GHSA-22fx-6r9m-r8h9.json", "severity": "MODERATE", "status": "changed", "summary": "libheif vulnerable to segmentation fault via floating point exception"}, {"advisory": "https://github.com/advisories/GHSA-539f-xcgw-2gjg", "aliases": ["CVE-2026-126349"], "commit": "https://github.com/github/advisory-database/commit/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487/advisories/github-reviewed/2026/11/GHSA-539f-xcgw-2gjg/GHSA-539f-xcgw-2gjg.json", "id": "GHSA-539f-xcgw-2gjg", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-539f-xcgw-2gjg/GHSA-539f-xcgw-2gjg.json", "severity": "LOW", "status": "published", "summary": "Addressable display_uri can show misleading hosts containing bidi and invisible characters"}, {"advisory": "https://github.com/advisories/GHSA-9crm-g4mf-wc5j", "aliases": ["CVE-2026-126348"], "commit": "https://github.com/github/advisory-database/commit/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487/advisories/github-reviewed/2026/11/GHSA-9crm-g4mf-wc5j/GHSA-9crm-g4mf-wc5j.json", "id": "GHSA-9crm-g4mf-wc5j", "packages": ["addressable"], "path": "advisories/github-reviewed/2026/11/GHSA-9crm-g4mf-wc5j/GHSA-9crm-g4mf-wc5j.json", "severity": "MODERATE", "status": "published", "summary": "Addressable display_uri can show misleading hosts with invalid Punycode A-labels"}, {"advisory": "https://github.com/advisories/GHSA-73v3-wf97-vpgj", "aliases": ["CVE-2026-126366"], "commit": "https://github.com/github/advisory-database/commit/3171910415f877765a1635d1c70d7274932baa3f", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/3171910415f877765a1635d1c70d7274932baa3f/advisories/github-reviewed/2026/11/GHSA-73v3-wf97-vpgj/GHSA-73v3-wf97-vpgj.json", "id": "GHSA-73v3-wf97-vpgj", "packages": ["msgpack"], "path": "advisories/github-reviewed/2026/11/GHSA-73v3-wf97-vpgj/GHSA-73v3-wf97-vpgj.json", "severity": "HIGH", "status": "published", "summary": "msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM"}, {"advisory": "https://github.com/advisories/GHSA-gg5j-6742-v827", "aliases": ["CVE-2026-128065"], "commit": "https://github.com/github/advisory-database/commit/6cb475c27ff368dee6735c8d6fb1fcb883f08a06", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/6cb475c27ff368dee6735c8d6fb1fcb883f08a06/advisories/github-reviewed/2026/11/GHSA-gg5j-6742-v827/GHSA-gg5j-6742-v827.json", "id": "GHSA-gg5j-6742-v827", "packages": ["@grpc/grpc-js-xds"], "path": "advisories/github-reviewed/2026/11/GHSA-gg5j-6742-v827/GHSA-gg5j-6742-v827.json", "severity": "MODERATE", "status": "published", "summary": "@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied"}, {"advisory": "https://github.com/advisories/GHSA-r7hq-q2xm-6c5m", "aliases": ["CVE-2026-126367"], "commit": "https://github.com/github/advisory-database/commit/065329326fcdec6f14d08500418cbcdceb8c6028", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/065329326fcdec6f14d08500418cbcdceb8c6028/advisories/github-reviewed/2026/11/GHSA-r7hq-q2xm-6c5m/GHSA-r7hq-q2xm-6c5m.json", "id": "GHSA-r7hq-q2xm-6c5m", "packages": ["@grpc/grpc-js-xds"], "path": "advisories/github-reviewed/2026/11/GHSA-r7hq-q2xm-6c5m/GHSA-r7hq-q2xm-6c5m.json", "severity": "MODERATE", "status": "published", "summary": "@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation"}, {"advisory": "https://github.com/advisories/GHSA-3gg2-335m-rxc6", "aliases": ["CVE-2026-126359"], "commit": "https://github.com/github/advisory-database/commit/1d2ec873ee46d959c071559657664272578a25a3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1d2ec873ee46d959c071559657664272578a25a3/advisories/github-reviewed/2026/11/GHSA-3gg2-335m-rxc6/GHSA-3gg2-335m-rxc6.json", "id": "GHSA-3gg2-335m-rxc6", "packages": ["hono"], "path": "advisories/github-reviewed/2026/11/GHSA-3gg2-335m-rxc6/GHSA-3gg2-335m-rxc6.json", "severity": "LOW", "status": "published", "summary": "Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection"}, {"advisory": "https://github.com/advisories/GHSA-4m76-xfj5-7975", "aliases": ["CVE-2026-126357"], "commit": "https://github.com/github/advisory-database/commit/1d2ec873ee46d959c071559657664272578a25a3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1d2ec873ee46d959c071559657664272578a25a3/advisories/github-reviewed/2026/11/GHSA-4m76-xfj5-7975/GHSA-4m76-xfj5-7975.json", "id": "GHSA-4m76-xfj5-7975", "packages": ["hono"], "path": "advisories/github-reviewed/2026/11/GHSA-4m76-xfj5-7975/GHSA-4m76-xfj5-7975.json", "severity": "MODERATE", "status": "published", "summary": "Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix"}, {"advisory": "https://github.com/advisories/GHSA-h7mg-cq63-vhpq", "aliases": ["CVE-2026-126358"], "commit": "https://github.com/github/advisory-database/commit/1d2ec873ee46d959c071559657664272578a25a3", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1d2ec873ee46d959c071559657664272578a25a3/advisories/github-reviewed/2026/11/GHSA-h7mg-cq63-vhpq/GHSA-h7mg-cq63-vhpq.json", "id": "GHSA-h7mg-cq63-vhpq", "packages": ["hono"], "path": "advisories/github-reviewed/2026/11/GHSA-h7mg-cq63-vhpq/GHSA-h7mg-cq63-vhpq.json", "severity": "MODERATE", "status": "published", "summary": "Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator"}, {"advisory": "https://github.com/advisories/GHSA-4h7h-rv7c-7m2v", "aliases": ["CVE-2026-126356"], "commit": "https://github.com/github/advisory-database/commit/c6aa3a3a300705d4948b4bbfbcf25fdf0cf8a1fb", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/c6aa3a3a300705d4948b4bbfbcf25fdf0cf8a1fb/advisories/github-reviewed/2026/11/GHSA-4h7h-rv7c-7m2v/GHSA-4h7h-rv7c-7m2v.json", "id": "GHSA-4h7h-rv7c-7m2v", "packages": ["hono"], "path": "advisories/github-reviewed/2026/11/GHSA-4h7h-rv7c-7m2v/GHSA-4h7h-rv7c-7m2v.json", "severity": "MODERATE", "status": "published", "summary": "Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters"}, {"advisory": "https://github.com/advisories/GHSA-46wx-v44x-9hh2", "aliases": ["CVE-2026-126355"], "commit": "https://github.com/github/advisory-database/commit/627e9e9022715e52f79f6e4b114edce60db4edf1", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/627e9e9022715e52f79f6e4b114edce60db4edf1/advisories/github-reviewed/2026/11/GHSA-46wx-v44x-9hh2/GHSA-46wx-v44x-9hh2.json", "id": "GHSA-46wx-v44x-9hh2", "packages": ["hono"], "path": "advisories/github-reviewed/2026/11/GHSA-46wx-v44x-9hh2/GHSA-46wx-v44x-9hh2.json", "severity": "MODERATE", "status": "published", "summary": "Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)"}, {"advisory": "https://github.com/advisories/GHSA-3w93-6hmw-whh4", "aliases": ["CVE-2026-126084"], "commit": "https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-3w93-6hmw-whh4/GHSA-3w93-6hmw-whh4.json", "id": "GHSA-3w93-6hmw-whh4", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-3w93-6hmw-whh4/GHSA-3w93-6hmw-whh4.json", "severity": "MODERATE", "status": "published", "summary": "Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control"}, {"advisory": "https://github.com/advisories/GHSA-wm3x-v3qw-4jh3", "aliases": ["CVE-2026-126081"], "commit": "https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-wm3x-v3qw-4jh3/GHSA-wm3x-v3qw-4jh3.json", "id": "GHSA-wm3x-v3qw-4jh3", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-wm3x-v3qw-4jh3/GHSA-wm3x-v3qw-4jh3.json", "severity": "HIGH", "status": "published", "summary": "Action Pack: Possible Strong Parameters Bypass in Parameters#each_key"}, {"advisory": "https://github.com/advisories/GHSA-wqgw-9xfh-qf2g", "aliases": ["CVE-2026-128066"], "commit": "https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-wqgw-9xfh-qf2g/GHSA-wqgw-9xfh-qf2g.json", "id": "GHSA-wqgw-9xfh-qf2g", "packages": ["Pillow"], "path": "advisories/github-reviewed/2026/11/GHSA-wqgw-9xfh-qf2g/GHSA-wqgw-9xfh-qf2g.json", "severity": "MODERATE", "status": "published", "summary": "Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data"}, {"advisory": "https://github.com/advisories/GHSA-xcvg-w56q-r89m", "aliases": ["CVE-2026-128067"], "commit": "https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-xcvg-w56q-r89m/GHSA-xcvg-w56q-r89m.json", "id": "GHSA-xcvg-w56q-r89m", "packages": ["Pillow"], "path": "advisories/github-reviewed/2026/11/GHSA-xcvg-w56q-r89m/GHSA-xcvg-w56q-r89m.json", "severity": "HIGH", "status": "published", "summary": "Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size"}, {"advisory": "https://github.com/advisories/GHSA-2p2f-4rq4-gjwc", "aliases": ["CVE-2026-126079"], "commit": "https://github.com/github/advisory-database/commit/7ac5fec35965b4232c0784cd79ee89b565e06a05", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/7ac5fec35965b4232c0784cd79ee89b565e06a05/advisories/github-reviewed/2026/11/GHSA-2p2f-4rq4-gjwc/GHSA-2p2f-4rq4-gjwc.json", "id": "GHSA-2p2f-4rq4-gjwc", "packages": ["actionview"], "path": "advisories/github-reviewed/2026/11/GHSA-2p2f-4rq4-gjwc/GHSA-2p2f-4rq4-gjwc.json", "severity": "MODERATE", "status": "published", "summary": "Action View: Possible XSS vulnerability in text helpers"}, {"advisory": "https://github.com/advisories/GHSA-rq8q-p985-fjq7", "aliases": ["CVE-2026-126070"], "commit": "https://github.com/github/advisory-database/commit/7ac5fec35965b4232c0784cd79ee89b565e06a05", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/7ac5fec35965b4232c0784cd79ee89b565e06a05/advisories/github-reviewed/2026/11/GHSA-rq8q-p985-fjq7/GHSA-rq8q-p985-fjq7.json", "id": "GHSA-rq8q-p985-fjq7", "packages": ["actionview"], "path": "advisories/github-reviewed/2026/11/GHSA-rq8q-p985-fjq7/GHSA-rq8q-p985-fjq7.json", "severity": "MODERATE", "status": "published", "summary": "Action View: Possible XSS vulnerability in strip_tags"}, {"advisory": "https://github.com/advisories/GHSA-v6rj-xm57-3p59", "aliases": ["CVE-2026-126078"], "commit": "https://github.com/github/advisory-database/commit/7ac5fec35965b4232c0784cd79ee89b565e06a05", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/7ac5fec35965b4232c0784cd79ee89b565e06a05/advisories/github-reviewed/2026/11/GHSA-v6rj-xm57-3p59/GHSA-v6rj-xm57-3p59.json", "id": "GHSA-v6rj-xm57-3p59", "packages": ["actionview"], "path": "advisories/github-reviewed/2026/11/GHSA-v6rj-xm57-3p59/GHSA-v6rj-xm57-3p59.json", "severity": "MODERATE", "status": "published", "summary": "Action View: Possible XSS vulnerability in highlight helper"}, {"advisory": "https://github.com/advisories/GHSA-rwvh-fw6r-pwvp", "aliases": ["CVE-2026-126072"], "commit": "https://github.com/github/advisory-database/commit/89e35a6136da4b6fef645503a1ddcd7ff496f51e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/89e35a6136da4b6fef645503a1ddcd7ff496f51e/advisories/github-reviewed/2026/11/GHSA-rwvh-fw6r-pwvp/GHSA-rwvh-fw6r-pwvp.json", "id": "GHSA-rwvh-fw6r-pwvp", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-rwvh-fw6r-pwvp/GHSA-rwvh-fw6r-pwvp.json", "severity": "MODERATE", "status": "published", "summary": "Action Pack: Possible DoS vulnerability in Action Controller Live streaming"}, {"advisory": "https://github.com/advisories/GHSA-x6mj-8jx9-qhqv", "aliases": ["CVE-2026-126077"], "commit": "https://github.com/github/advisory-database/commit/89e35a6136da4b6fef645503a1ddcd7ff496f51e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/89e35a6136da4b6fef645503a1ddcd7ff496f51e/advisories/github-reviewed/2026/11/GHSA-x6mj-8jx9-qhqv/GHSA-x6mj-8jx9-qhqv.json", "id": "GHSA-x6mj-8jx9-qhqv", "packages": ["actionpack"], "path": "advisories/github-reviewed/2026/11/GHSA-x6mj-8jx9-qhqv/GHSA-x6mj-8jx9-qhqv.json", "severity": "MODERATE", "status": "published", "summary": "Action Pack: Possible sensitive session information leak in Active Storage proxy mode"}, {"advisory": "https://github.com/advisories/GHSA-f3w6-w445-fwh9", "aliases": ["CVE-2026-122006"], "commit": "https://github.com/github/advisory-database/commit/a0dc66bb031dd931c8f7037f2c2adf1196b064d7", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/a0dc66bb031dd931c8f7037f2c2adf1196b064d7/advisories/github-reviewed/2026/11/GHSA-f3w6-w445-fwh9/GHSA-f3w6-w445-fwh9.json", "id": "GHSA-f3w6-w445-fwh9", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-f3w6-w445-fwh9/GHSA-f3w6-w445-fwh9.json", "severity": "CRITICAL", "status": "published", "summary": "Active Storage: Possible arbitrary file write and read in image analysis"}, {"advisory": "https://github.com/advisories/GHSA-wgv4-95jc-33jm", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/a0dc66bb031dd931c8f7037f2c2adf1196b064d7", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/a0dc66bb031dd931c8f7037f2c2adf1196b064d7/advisories/github-reviewed/2026/11/GHSA-wgv4-95jc-33jm/GHSA-wgv4-95jc-33jm.json", "id": "GHSA-wgv4-95jc-33jm", "packages": ["activestorage"], "path": "advisories/github-reviewed/2026/11/GHSA-wgv4-95jc-33jm/GHSA-wgv4-95jc-33jm.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory: Active Storage: Possible arbitrary file write and read in Active Storage image analysis"}], "sourceId": "advisories-reviewed", "text": "On November 12, 2026, GitHub's security advisory list published 49 new advisories, changed 5, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 37671, "fingerprint": "d33fc92b80c9cf10b05024e7fb3ee84e6fe879a86abd1f4c9c6ee9e19f45d429", "url": "https://flarereef.flareforward.com/files/watch/d33fc92b80c9cf10b05024e7fb3ee84e6fe879a86abd1f4c9c6ee9e19f45d429.json"}}, "project": {"projectId": 20, "name": "Security advisories (GitHub reviewed)", "kind": "watch", "keeper": "GitHub", "jurisdiction": "", "markText": "GH", "shape": "", "what": "GitHub's security advisory list", "repoUrl": "https://github.com/github/advisory-database", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "chunk": "day"}, "date": "2026-11-13", "author": {"name": "Flare Reef watcher", "handle": "", "verified": false}}