{"note": {"noteId": 472, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0x553830ff40c92d254d55eb16614f9d9ce643f192fde0e18c8f18460af36da5f0", "content": "{\"counts\":{\"changed\":2,\"published\":41,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-13\",\"fullList\":{\"bytes\":30476,\"fingerprint\":\"02ed468f5f46842bd8b974c3cd8fe0c23e32f9f8da917114e374247943ed1139\",\"url\":\"https://flarereef.flareforward.com/files/watch/02ed468f5f46842bd8b974c3cd8fe0c23e32f9f8da917114e374247943ed1139.json\"},\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-14T02:13:54Z\",\"rows\":[{\"advisory\":\"https://github.com/advisories/GHSA-mfg3-p6m3-gjgr\",\"aliases\":[\"CVE-2026-46448\"],\"commit\":\"https://github.com/github/advisory-database/commit/afed71a60fe27fb31a448c718b922ba1883a8747\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/afed71a60fe27fb31a448c718b922ba1883a8747/advisories/github-reviewed/2026/06/GHSA-mfg3-p6m3-gjgr/GHSA-mfg3-p6m3-gjgr.json\",\"id\":\"GHSA-mfg3-p6m3-gjgr\",\"packages\":[\"nova\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-mfg3-p6m3-gjgr/GHSA-mfg3-p6m3-gjgr.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints\"},{\"advisory\":\"https://github.com/advisories/GHSA-4j63-6c4x-wfg4\",\"aliases\":[\"CVE-2026-126192\"],\"commit\":\"https://github.com/github/advisory-database/commit/dd3621032506cd31b4606029323f9cc10e280ba1\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/dd3621032506cd31b4606029323f9cc10e280ba1/advisories/github-reviewed/2026/11/GHSA-4j63-6c4x-wfg4/GHSA-4j63-6c4x-wfg4.json\",\"id\":\"GHSA-4j63-6c4x-wfg4\",\"packages\":[\"soupsieve\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-4j63-6c4x-wfg4/GHSA-4j63-6c4x-wfg4.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time\"},{\"advisory\":\"https://github.com/advisories/GHSA-mmhr-3c5m-f64f\",\"aliases\":[\"CVE-2026-126190\"],\"commit\":\"https://github.com/github/advisory-database/commit/3bd657d41e18ea884042f635f43e3952435d2241\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/3bd657d41e18ea884042f635f43e3952435d2241/advisories/github-reviewed/2026/11/GHSA-mmhr-3c5m-f64f/GHSA-mmhr-3c5m-f64f.json\",\"id\":\"GHSA-mmhr-3c5m-f64f\",\"packages\":[\"soupsieve\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-mmhr-3c5m-f64f/GHSA-mmhr-3c5m-f64f.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Soup Sieve: Polynomial-time denial of service in the descendant combinator\"},{\"advisory\":\"https://github.com/advisories/GHSA-x585-4vv8-2mh2\",\"aliases\":[\"CVE-2026-100397\"],\"commit\":\"https://github.com/github/advisory-database/commit/6df69917e10740d3ac1b7bb4cb71ffcc5ea4e82b\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/6df69917e10740d3ac1b7bb4cb71ffcc5ea4e82b/advisories/github-reviewed/2026/11/GHSA-x585-4vv8-2mh2/GHSA-x585-4vv8-2mh2.json\",\"id\":\"GHSA-x585-4vv8-2mh2\",\"packages\":[\"rucio\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-x585-4vv8-2mh2/GHSA-x585-4vv8-2mh2.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Rucio: Unauthenticated administrator impersonation through SSH challenge tokens\"},{\"advisory\":\"https://github.com/advisories/GHSA-v653-r55g-hcmg\",\"aliases\":[\"CVE-2025-13327\"],\"commit\":\"https://github.com/github/advisory-database/commit/be31a8d61d5d9e4c101caa4f7506105dda96862b\",\"ecosystems\":[\"crates.io\"],\"file\":\"https://github.com/github/advisory-database/blob/be31a8d61d5d9e4c101caa4f7506105dda96862b/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json\",\"id\":\"GHSA-v653-r55g-hcmg\",\"packages\":[\"uv\"],\"path\":\"advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"uv has ZIP payload obfuscation through parsing differentials\"},{\"advisory\":\"https://github.com/advisories/GHSA-7g44-g9rc-x53w\",\"aliases\":[\"CVE-2026-126193\"],\"commit\":\"https://github.com/github/advisory-database/commit/d56a454765269424437dc69b51cc71da6a220842\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/d56a454765269424437dc69b51cc71da6a220842/advisories/github-reviewed/2026/11/GHSA-7g44-g9rc-x53w/GHSA-7g44-g9rc-x53w.json\",\"id\":\"GHSA-7g44-g9rc-x53w\",\"packages\":[\"soupsieve\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-7g44-g9rc-x53w/GHSA-7g44-g9rc-x53w.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack\"},{\"advisory\":\"https://github.com/advisories/GHSA-6655-6qjp-jx7x\",\"aliases\":[\"CVE-2026-126191\"],\"commit\":\"https://github.com/github/advisory-database/commit/d7f40b238b018b57230354b3a98efb213aebefe4\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/d7f40b238b018b57230354b3a98efb213aebefe4/advisories/github-reviewed/2026/11/GHSA-6655-6qjp-jx7x/GHSA-6655-6qjp-jx7x.json\",\"id\":\"GHSA-6655-6qjp-jx7x\",\"packages\":[\"soupsieve\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-6655-6qjp-jx7x/GHSA-6655-6qjp-jx7x.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Soup Sieve: Exponential ReDoS in selector compilation via \\\\9-run in CSS_ESCAPES/IDENTIFIER\"},{\"advisory\":\"https://github.com/advisories/GHSA-mf5v-w3w3-f6cg\",\"aliases\":[\"CVE-2026-126360\"],\"commit\":\"https://github.com/github/advisory-database/commit/cc2b7f626cffec0787b9717357a36f589225616e\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/cc2b7f626cffec0787b9717357a36f589225616e/advisories/github-reviewed/2026/11/GHSA-mf5v-w3w3-f6cg/GHSA-mf5v-w3w3-f6cg.json\",\"id\":\"GHSA-mf5v-w3w3-f6cg\",\"packages\":[\"opentelemetry-api\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-mf5v-w3w3-f6cg/GHSA-mf5v-w3w3-f6cg.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing\"},{\"advisory\":\"https://github.com/advisories/GHSA-cpgf-5mjf-73p7\",\"aliases\":[\"CVE-2026-128068\"],\"commit\":\"https://github.com/github/advisory-database/commit/8150ca091a4fb76146295fcc427e639a674ff72e\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/8150ca091a4fb76146295fcc427e639a674ff72e/advisories/github-reviewed/2026/11/GHSA-cpgf-5mjf-73p7/GHSA-cpgf-5mjf-73p7.json\",\"id\":\"GHSA-cpgf-5mjf-73p7\",\"packages\":[\"rails-html-sanitizer\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-cpgf-5mjf-73p7/GHSA-cpgf-5mjf-73p7.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"rails-html-sanitizer: Possible regular expression denial of service with certain configurations\"},{\"advisory\":\"https://github.com/advisories/GHSA-jv6m-48w5-5rpr\",\"aliases\":[\"CVE-2026-128079\"],\"commit\":\"https://github.com/github/advisory-database/commit/74d9b65c1cba9b1f9bf6fdb07a364d83ca7de25f\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/74d9b65c1cba9b1f9bf6fdb07a364d83ca7de25f/advisories/github-reviewed/2026/11/GHSA-jv6m-48w5-5rpr/GHSA-jv6m-48w5-5rpr.json\",\"id\":\"GHSA-jv6m-48w5-5rpr\",\"packages\":[\"envd\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-jv6m-48w5-5rpr/GHSA-jv6m-48w5-5rpr.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"envd: Host file disclosure through requirements path traversal and TOCTOU\"},{\"advisory\":\"https://github.com/advisories/GHSA-h7wh-q2qr-458c\",\"aliases\":[\"CVE-2026-128069\"],\"commit\":\"https://github.com/github/advisory-database/commit/fd2c792c5ec3a2c514949d658e7c6078ac643f69\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/fd2c792c5ec3a2c514949d658e7c6078ac643f69/advisories/github-reviewed/2026/11/GHSA-h7wh-q2qr-458c/GHSA-h7wh-q2qr-458c.json\",\"id\":\"GHSA-h7wh-q2qr-458c\",\"packages\":[\"rails-html-sanitizer\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-h7wh-q2qr-458c/GHSA-h7wh-q2qr-458c.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls\"},{\"advisory\":\"https://github.com/advisories/GHSA-mjrq-cffv-q4qc\",\"aliases\":[\"CVE-2026-128070\"],\"commit\":\"https://github.com/github/advisory-database/commit/7a8ac86ae3359e59e5040b4bec62f6289138f79e\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/7a8ac86ae3359e59e5040b4bec62f6289138f79e/advisories/github-reviewed/2026/11/GHSA-mjrq-cffv-q4qc/GHSA-mjrq-cffv-q4qc.json\",\"id\":\"GHSA-mjrq-cffv-q4qc\",\"packages\":[\"@nuxt/schema\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-mjrq-cffv-q4qc/GHSA-mjrq-cffv-q4qc.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file\"},{\"advisory\":\"https://github.com/advisories/GHSA-r3h5-4585-7x3w\",\"aliases\":[\"CVE-2026-126364\"],\"commit\":\"https://github.com/github/advisory-database/commit/1936c65b1508be11265709a09229d810010ab8fb\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/1936c65b1508be11265709a09229d810010ab8fb/advisories/github-reviewed/2026/11/GHSA-r3h5-4585-7x3w/GHSA-r3h5-4585-7x3w.json\",\"id\":\"GHSA-r3h5-4585-7x3w\",\"packages\":[\"@astrojs/node\",\"astro\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-r3h5-4585-7x3w/GHSA-r3h5-4585-7x3w.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems\"},{\"advisory\":\"https://github.com/advisories/GHSA-mh32-jxcr-mh9f\",\"aliases\":[\"CVE-2026-126361\"],\"commit\":\"https://github.com/github/advisory-database/commit/e74debc9a3a735a867862dc0b19384d0c430fc8f\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/e74debc9a3a735a867862dc0b19384d0c430fc8f/advisories/github-reviewed/2026/11/GHSA-mh32-jxcr-mh9f/GHSA-mh32-jxcr-mh9f.json\",\"id\":\"GHSA-mh32-jxcr-mh9f\",\"packages\":[\"astro\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-mh32-jxcr-mh9f/GHSA-mh32-jxcr-mh9f.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Astro: XSS via attribute injection in dynamic tag names\"},{\"advisory\":\"https://github.com/advisories/GHSA-gpwp-5797-mjff\",\"aliases\":[\"CVE-2026-128081\"],\"commit\":\"https://github.com/github/advisory-database/commit/364007edb49dabbc998eee1c6079f62c0155fbc9\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/364007edb49dabbc998eee1c6079f62c0155fbc9/advisories/github-reviewed/2026/11/GHSA-gpwp-5797-mjff/GHSA-gpwp-5797-mjff.json\",\"id\":\"GHSA-gpwp-5797-mjff\",\"packages\":[\"AutoMapper\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-gpwp-5797-mjff/GHSA-gpwp-5797-mjff.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth\"},{\"advisory\":\"https://github.com/advisories/GHSA-63hm-g96r-2m2q\",\"aliases\":[\"CVE-2026-128083\"],\"commit\":\"https://github.com/github/advisory-database/commit/4ee9791db3416d33f863c149937addcfa972e8ee\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/4ee9791db3416d33f863c149937addcfa972e8ee/advisories/github-reviewed/2026/11/GHSA-63hm-g96r-2m2q/GHSA-63hm-g96r-2m2q.json\",\"id\":\"GHSA-63hm-g96r-2m2q\",\"packages\":[\"laravel/framework\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-63hm-g96r-2m2q/GHSA-63hm-g96r-2m2q.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Laravel: Task Output Injection - Concurrency Process\"},{\"advisory\":\"https://github.com/advisories/GHSA-4fqr-96q8-xrfx\",\"aliases\":[\"CVE-2026-128084\"],\"commit\":\"https://github.com/github/advisory-database/commit/c289804e665aac323c081789c7f137423efbdd24\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/c289804e665aac323c081789c7f137423efbdd24/advisories/github-reviewed/2026/11/GHSA-4fqr-96q8-xrfx/GHSA-4fqr-96q8-xrfx.json\",\"id\":\"GHSA-4fqr-96q8-xrfx\",\"packages\":[\"sqlite3\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-4fqr-96q8-xrfx/GHSA-4fqr-96q8-xrfx.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger\"},{\"advisory\":\"https://github.com/advisories/GHSA-q7gw-24fr-5p69\",\"aliases\":[\"CVE-2026-128085\"],\"commit\":\"https://github.com/github/advisory-database/commit/1eb06e7d63453b9fa0e56cdf15d2795cbb8fdcec\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/1eb06e7d63453b9fa0e56cdf15d2795cbb8fdcec/advisories/github-reviewed/2026/11/GHSA-q7gw-24fr-5p69/GHSA-q7gw-24fr-5p69.json\",\"id\":\"GHSA-q7gw-24fr-5p69\",\"packages\":[\"go.opentelemetry.io/otel/sdk\",\"go.opentelemetry.io/otel/sdk/log\",\"go.opentelemetry.io/otel/trace\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-q7gw-24fr-5p69/GHSA-q7gw-24fr-5p69.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes\"},{\"advisory\":\"https://github.com/advisories/GHSA-rrfc-gjm9-cgrj\",\"aliases\":[\"CVE-2026-128086\"],\"commit\":\"https://github.com/github/advisory-database/commit/1c957b7351b56ed8e37cccf75243b765150e0d93\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/1c957b7351b56ed8e37cccf75243b765150e0d93/advisories/github-reviewed/2026/11/GHSA-rrfc-gjm9-cgrj/GHSA-rrfc-gjm9-cgrj.json\",\"id\":\"GHSA-rrfc-gjm9-cgrj\",\"packages\":[\"go.opentelemetry.io/otel/baggage\",\"go.opentelemetry.io/otel/propagation\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-rrfc-gjm9-cgrj/GHSA-rrfc-gjm9-cgrj.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification\"},{\"advisory\":\"https://github.com/advisories/GHSA-736f-c93q-9fwx\",\"aliases\":[\"CVE-2026-128088\"],\"commit\":\"https://github.com/github/advisory-database/commit/8242cb021a02f0eb4608ee4ab878c3ab88b5a34e\",\"ecosystems\":[\"crates.io\"],\"file\":\"https://github.com/github/advisory-database/blob/8242cb021a02f0eb4608ee4ab878c3ab88b5a34e/advisories/github-reviewed/2026/11/GHSA-736f-c93q-9fwx/GHSA-736f-c93q-9fwx.json\",\"id\":\"GHSA-736f-c93q-9fwx\",\"packages\":[\"russh\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-736f-c93q-9fwx/GHSA-736f-c93q-9fwx.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"russh try_sign: asynchronous confirmation can sign after agent lock\"},{\"advisory\":\"https://github.com/advisories/GHSA-9264-jvgf-6w2f\",\"aliases\":[\"CVE-2026-128087\"],\"commit\":\"https://github.com/github/advisory-database/commit/1878d81171e5bed193c1e7da4474ac280a7370ee\",\"ecosystems\":[\"crates.io\"],\"file\":\"https://github.com/github/advisory-database/blob/1878d81171e5bed193c1e7da4474ac280a7370ee/advisories/github-reviewed/2026/11/GHSA-9264-jvgf-6w2f/GHSA-9264-jvgf-6w2f.json\",\"id\":\"GHSA-9264-jvgf-6w2f\",\"packages\":[\"russh\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-9264-jvgf-6w2f/GHSA-9264-jvgf-6w2f.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"russh kex_done: Shared-secret callback runs before server host-key verification\"},{\"advisory\":\"https://github.com/advisories/GHSA-6vhm-j9h7-f9gh\",\"aliases\":[\"CVE-2026-128082\"],\"commit\":\"https://github.com/github/advisory-database/commit/dc5824fa4e7cf15854abb24b8b912fbb1408c1ea\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/dc5824fa4e7cf15854abb24b8b912fbb1408c1ea/advisories/github-reviewed/2026/11/GHSA-6vhm-j9h7-f9gh/GHSA-6vhm-j9h7-f9gh.json\",\"id\":\"GHSA-6vhm-j9h7-f9gh\",\"packages\":[\"AutoMapper\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-6vhm-j9h7-f9gh/GHSA-6vhm-j9h7-f9gh.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"AutoMapper: Uncontrolled Recursion with Constructor Parameters\"},{\"advisory\":\"https://github.com/advisories/GHSA-3v2p-hm54-8qcq\",\"aliases\":[\"CVE-2026-128080\"],\"commit\":\"https://github.com/github/advisory-database/commit/2d0f959d94515f3ddcbd0ccddfa8ae21199d1cd8\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/2d0f959d94515f3ddcbd0ccddfa8ae21199d1cd8/advisories/github-reviewed/2026/11/GHSA-3v2p-hm54-8qcq/GHSA-3v2p-hm54-8qcq.json\",\"id\":\"GHSA-3v2p-hm54-8qcq\",\"packages\":[\"@opentelemetry/instrumentation-http\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-3v2p-hm54-8qcq/GHSA-3v2p-hm54-8qcq.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http\"},{\"advisory\":\"https://github.com/advisories/GHSA-r99w-jh2x-3mg9\",\"aliases\":[\"CVE-2026-128077\"],\"commit\":\"https://github.com/github/advisory-database/commit/23f11208c0d7dd60d67baf206f1b052aed30184f\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/23f11208c0d7dd60d67baf206f1b052aed30184f/advisories/github-reviewed/2026/11/GHSA-r99w-jh2x-3mg9/GHSA-r99w-jh2x-3mg9.json\",\"id\":\"GHSA-r99w-jh2x-3mg9\",\"packages\":[\"@nuxt/nitro-server\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-r99w-jh2x-3mg9/GHSA-r99w-jh2x-3mg9.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes\"},{\"advisory\":\"https://github.com/advisories/GHSA-vvf4-9x63-8xvv\",\"aliases\":[\"CVE-2026-128089\"],\"commit\":\"https://github.com/github/advisory-database/commit/51afb096ea630f0fc668e7facbeee9c032207251\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/51afb096ea630f0fc668e7facbeee9c032207251/advisories/github-reviewed/2026/11/GHSA-vvf4-9x63-8xvv/GHSA-vvf4-9x63-8xvv.json\",\"id\":\"GHSA-vvf4-9x63-8xvv\",\"packages\":[\"dnspython\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-vvf4-9x63-8xvv/GHSA-vvf4-9x63-8xvv.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"dnspython has excessive memory and CPU use\"},{\"advisory\":\"https://github.com/advisories/GHSA-5cjw-f85j-cv6r\",\"aliases\":[\"CVE-2026-126347\"],\"commit\":\"https://github.com/github/advisory-database/commit/6cae5ca403c6f54030887cec6cef34f5c2c27843\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/6cae5ca403c6f54030887cec6cef34f5c2c27843/advisories/github-reviewed/2026/11/GHSA-5cjw-f85j-cv6r/GHSA-5cjw-f85j-cv6r.json\",\"id\":\"GHSA-5cjw-f85j-cv6r\",\"packages\":[\"tornado\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-5cjw-f85j-cv6r/GHSA-5cjw-f85j-cv6r.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Tornado: Open redirect via triple-slash redirect paths\"},{\"advisory\":\"https://github.com/advisories/GHSA-rqw3-x7hx-mm3p\",\"aliases\":[\"CVE-2026-128123\"],\"commit\":\"https://github.com/github/advisory-database/commit/8dd2303a59acd0de87df7b38e5c05eb68b4125d2\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/8dd2303a59acd0de87df7b38e5c05eb68b4125d2/advisories/github-reviewed/2026/11/GHSA-rqw3-x7hx-mm3p/GHSA-rqw3-x7hx-mm3p.json\",\"id\":\"GHSA-rqw3-x7hx-mm3p\",\"packages\":[\"@sveltejs/adapter-node\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-rqw3-x7hx-mm3p/GHSA-rqw3-x7hx-mm3p.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`\"},{\"advisory\":\"https://github.com/advisories/GHSA-5wg4-q3ww-283h\",\"aliases\":[\"CVE-2026-128122\"],\"commit\":\"https://github.com/github/advisory-database/commit/cebb49976e0b3ee817b35f66b4d2a5da2e544529\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/cebb49976e0b3ee817b35f66b4d2a5da2e544529/advisories/github-reviewed/2026/11/GHSA-5wg4-q3ww-283h/GHSA-5wg4-q3ww-283h.json\",\"id\":\"GHSA-5wg4-q3ww-283h\",\"packages\":[\"@sveltejs/adapter-cloudflare\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-5wg4-q3ww-283h/GHSA-5wg4-q3ww-283h.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`\"},{\"advisory\":\"https://github.com/advisories/GHSA-jf9x-2fg2-hx4w\",\"aliases\":[\"CVE-2026-128121\"],\"commit\":\"https://github.com/github/advisory-database/commit/75ac9f2cfb812c35e651671de1c5051aabc7d44c\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/75ac9f2cfb812c35e651671de1c5051aabc7d44c/advisories/github-reviewed/2026/11/GHSA-jf9x-2fg2-hx4w/GHSA-jf9x-2fg2-hx4w.json\",\"id\":\"GHSA-jf9x-2fg2-hx4w\",\"packages\":[\"@sveltejs/adapter-vercel\",\"@sveltejs/adapter-static\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-jf9x-2fg2-hx4w/GHSA-jf9x-2fg2-hx4w.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static\"},{\"advisory\":\"https://github.com/advisories/GHSA-mw6w-2fmv-pvw3\",\"aliases\":[\"CVE-2026-128117\"],\"commit\":\"https://github.com/github/advisory-database/commit/1f7ecfc45ad984725f5eb83b3e89f376e0c7620b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/1f7ecfc45ad984725f5eb83b3e89f376e0c7620b/advisories/github-reviewed/2026/11/GHSA-mw6w-2fmv-pvw3/GHSA-mw6w-2fmv-pvw3.json\",\"id\":\"GHSA-mw6w-2fmv-pvw3\",\"packages\":[\"@sveltejs/kit\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-mw6w-2fmv-pvw3/GHSA-mw6w-2fmv-pvw3.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"SvelteKit: adapter-node crashes with an unhandled URIError when `reroute` rewrites malformed pathnames\"},{\"advisory\":\"https://github.com/advisories/GHSA-7r4r-6ppg-7ff8\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/c22e8d90df91a2c839f9a6cc8a4cf6a62b23cd91\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/c22e8d90df91a2c839f9a6cc8a4cf6a62b23cd91/advisories/github-reviewed/2026/11/GHSA-7r4r-6ppg-7ff8/GHSA-7r4r-6ppg-7ff8.json\",\"id\":\"GHSA-7r4r-6ppg-7ff8\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-7r4r-6ppg-7ff8/GHSA-7r4r-6ppg-7ff8.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox\"},{\"advisory\":\"https://github.com/advisories/GHSA-4hvg-fv5c-9936\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/407e74dc63e313f97227eca1c81414a5321500a4\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/407e74dc63e313f97227eca1c81414a5321500a4/advisories/github-reviewed/2026/11/GHSA-4hvg-fv5c-9936/GHSA-4hvg-fv5c-9936.json\",\"id\":\"GHSA-4hvg-fv5c-9936\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-4hvg-fv5c-9936/GHSA-4hvg-fv5c-9936.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: Unbounded CPU consumption in NLTK SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars\"},{\"advisory\":\"https://github.com/advisories/GHSA-qg35-44qx-7vrr\",\"aliases\":[\"CVE-2026-126304\"],\"commit\":\"https://github.com/github/advisory-database/commit/407e74dc63e313f97227eca1c81414a5321500a4\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/407e74dc63e313f97227eca1c81414a5321500a4/advisories/github-reviewed/2026/11/GHSA-qg35-44qx-7vrr/GHSA-qg35-44qx-7vrr.json\",\"id\":\"GHSA-qg35-44qx-7vrr\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-qg35-44qx-7vrr/GHSA-qg35-44qx-7vrr.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"NLTK: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox\"},{\"advisory\":\"https://github.com/advisories/GHSA-8fx7-8jr8-84rv\",\"aliases\":[\"CVE-2026-126303\"],\"commit\":\"https://github.com/github/advisory-database/commit/e2c68e60a557adcc8f075aae523046b9cf43232c\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/e2c68e60a557adcc8f075aae523046b9cf43232c/advisories/github-reviewed/2026/11/GHSA-8fx7-8jr8-84rv/GHSA-8fx7-8jr8-84rv.json\",\"id\":\"GHSA-8fx7-8jr8-84rv\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-8fx7-8jr8-84rv/GHSA-8fx7-8jr8-84rv.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"NLTK: Unbounded CPU consumption in SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars\"},{\"advisory\":\"https://github.com/advisories/GHSA-rg32-vgf9-927c\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/9162eba25b286e4a3da7c9e521d0368fa8212380\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/9162eba25b286e4a3da7c9e521d0368fa8212380/advisories/github-reviewed/2026/11/GHSA-rg32-vgf9-927c/GHSA-rg32-vgf9-927c.json\",\"id\":\"GHSA-rg32-vgf9-927c\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-rg32-vgf9-927c/GHSA-rg32-vgf9-927c.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop\"},{\"advisory\":\"https://github.com/advisories/GHSA-ffr9-mgrr-wcvr\",\"aliases\":[\"CVE-2026-126300\"],\"commit\":\"https://github.com/github/advisory-database/commit/e1ecbd9ea5eb397b26514ffb0e463872e3e5e8d1\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/e1ecbd9ea5eb397b26514ffb0e463872e3e5e8d1/advisories/github-reviewed/2026/11/GHSA-ffr9-mgrr-wcvr/GHSA-ffr9-mgrr-wcvr.json\",\"id\":\"GHSA-ffr9-mgrr-wcvr\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-ffr9-mgrr-wcvr/GHSA-ffr9-mgrr-wcvr.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"NLTK: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop\"},{\"advisory\":\"https://github.com/advisories/GHSA-gpwc-27cw-rh9r\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/96f64df1e8d2a1a4d3f7cf72e5c5a95a648fdfa1\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/96f64df1e8d2a1a4d3f7cf72e5c5a95a648fdfa1/advisories/github-reviewed/2026/11/GHSA-gpwc-27cw-rh9r/GHSA-gpwc-27cw-rh9r.json\",\"id\":\"GHSA-gpwc-27cw-rh9r\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-gpwc-27cw-rh9r/GHSA-gpwc-27cw-rh9r.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop\"},{\"advisory\":\"https://github.com/advisories/GHSA-g5wx-957h-f4wj\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/ad3f98cb12ad1c18dde899f31061ab667006429e\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/ad3f98cb12ad1c18dde899f31061ab667006429e/advisories/github-reviewed/2026/11/GHSA-g5wx-957h-f4wj/GHSA-g5wx-957h-f4wj.json\",\"id\":\"GHSA-g5wx-957h-f4wj\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-g5wx-957h-f4wj/GHSA-g5wx-957h-f4wj.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: Path Traversal in save_maxent_params / load_maxent_params Allow Arbitrary File READ/WRITE\"},{\"advisory\":\"https://github.com/advisories/GHSA-jh6r-h4rx-2j3w\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/ebf8894d236bef6d65a83096599b0bbad9083f50\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/ebf8894d236bef6d65a83096599b0bbad9083f50/advisories/github-reviewed/2026/11/GHSA-jh6r-h4rx-2j3w/GHSA-jh6r-h4rx-2j3w.json\",\"id\":\"GHSA-jh6r-h4rx-2j3w\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-jh6r-h4rx-2j3w/GHSA-jh6r-h4rx-2j3w.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: Quadratic-time CPU denial of service in NLTK CCG lexicon parser (fromstring) on wide bracket bodies and operator chains\"},{\"advisory\":\"https://github.com/advisories/GHSA-pp88-jhwj-5qh5\",\"aliases\":[\"CVE-2026-62683\"],\"commit\":\"https://github.com/github/advisory-database/commit/8246cfea1e11d78f953467f626b2b208e946ca83\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/8246cfea1e11d78f953467f626b2b208e946ca83/advisories/github-reviewed/2026/11/GHSA-pp88-jhwj-5qh5/GHSA-pp88-jhwj-5qh5.json\",\"id\":\"GHSA-pp88-jhwj-5qh5\",\"packages\":[\"github.com/filebrowser/filebrowser/v2\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-pp88-jhwj-5qh5/GHSA-pp88-jhwj-5qh5.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"File Browser: Trailing-slash directory deletion leaves public shares active for recreated paths\"}],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 13, 2026, GitHub's security advisory list published 41 new advisories, changed 2, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "https://flarereef.flareforward.com/files/watch/02ed468f5f46842bd8b974c3cd8fe0c23e32f9f8da917114e374247943ed1139.json", "txHash": "0x7e8c4cbdd01b9435644fc0bdb4a26f63531a9af39416db283326f15a8bb1340d", "receiptUrl": "https://flare-explorer.flare.network/tx/0x7e8c4cbdd01b9435644fc0bdb4a26f63531a9af39416db283326f15a8bb1340d", "blockNumber": 74479070, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": [], "parsed": {"counts": {"changed": 2, "published": 41, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-13", "kind": "watch-day", "recordedAt": "2026-11-14T02:13:54Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-mfg3-p6m3-gjgr", "aliases": ["CVE-2026-46448"], "commit": "https://github.com/github/advisory-database/commit/afed71a60fe27fb31a448c718b922ba1883a8747", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/afed71a60fe27fb31a448c718b922ba1883a8747/advisories/github-reviewed/2026/06/GHSA-mfg3-p6m3-gjgr/GHSA-mfg3-p6m3-gjgr.json", "id": "GHSA-mfg3-p6m3-gjgr", "packages": ["nova"], "path": "advisories/github-reviewed/2026/06/GHSA-mfg3-p6m3-gjgr/GHSA-mfg3-p6m3-gjgr.json", "severity": "MODERATE", "status": "changed", "summary": "OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints"}, {"advisory": "https://github.com/advisories/GHSA-4j63-6c4x-wfg4", "aliases": ["CVE-2026-126192"], "commit": "https://github.com/github/advisory-database/commit/dd3621032506cd31b4606029323f9cc10e280ba1", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/dd3621032506cd31b4606029323f9cc10e280ba1/advisories/github-reviewed/2026/11/GHSA-4j63-6c4x-wfg4/GHSA-4j63-6c4x-wfg4.json", "id": "GHSA-4j63-6c4x-wfg4", "packages": ["soupsieve"], "path": "advisories/github-reviewed/2026/11/GHSA-4j63-6c4x-wfg4/GHSA-4j63-6c4x-wfg4.json", "severity": "MODERATE", "status": "published", "summary": "Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time"}, {"advisory": "https://github.com/advisories/GHSA-mmhr-3c5m-f64f", "aliases": ["CVE-2026-126190"], "commit": "https://github.com/github/advisory-database/commit/3bd657d41e18ea884042f635f43e3952435d2241", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3bd657d41e18ea884042f635f43e3952435d2241/advisories/github-reviewed/2026/11/GHSA-mmhr-3c5m-f64f/GHSA-mmhr-3c5m-f64f.json", "id": "GHSA-mmhr-3c5m-f64f", "packages": ["soupsieve"], "path": "advisories/github-reviewed/2026/11/GHSA-mmhr-3c5m-f64f/GHSA-mmhr-3c5m-f64f.json", "severity": "HIGH", "status": "published", "summary": "Soup Sieve: Polynomial-time denial of service in the descendant combinator"}, {"advisory": "https://github.com/advisories/GHSA-x585-4vv8-2mh2", "aliases": ["CVE-2026-100397"], "commit": "https://github.com/github/advisory-database/commit/6df69917e10740d3ac1b7bb4cb71ffcc5ea4e82b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/6df69917e10740d3ac1b7bb4cb71ffcc5ea4e82b/advisories/github-reviewed/2026/11/GHSA-x585-4vv8-2mh2/GHSA-x585-4vv8-2mh2.json", "id": "GHSA-x585-4vv8-2mh2", "packages": ["rucio"], "path": "advisories/github-reviewed/2026/11/GHSA-x585-4vv8-2mh2/GHSA-x585-4vv8-2mh2.json", "severity": "CRITICAL", "status": "published", "summary": "Rucio: Unauthenticated administrator impersonation through SSH challenge tokens"}, {"advisory": "https://github.com/advisories/GHSA-v653-r55g-hcmg", "aliases": ["CVE-2025-13327"], "commit": "https://github.com/github/advisory-database/commit/be31a8d61d5d9e4c101caa4f7506105dda96862b", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/be31a8d61d5d9e4c101caa4f7506105dda96862b/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "id": "GHSA-v653-r55g-hcmg", "packages": ["uv"], "path": "advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "severity": "MODERATE", "status": "changed", "summary": "uv has ZIP payload obfuscation through parsing differentials"}, {"advisory": "https://github.com/advisories/GHSA-7g44-g9rc-x53w", "aliases": ["CVE-2026-126193"], "commit": "https://github.com/github/advisory-database/commit/d56a454765269424437dc69b51cc71da6a220842", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/d56a454765269424437dc69b51cc71da6a220842/advisories/github-reviewed/2026/11/GHSA-7g44-g9rc-x53w/GHSA-7g44-g9rc-x53w.json", "id": "GHSA-7g44-g9rc-x53w", "packages": ["soupsieve"], "path": "advisories/github-reviewed/2026/11/GHSA-7g44-g9rc-x53w/GHSA-7g44-g9rc-x53w.json", "severity": "MODERATE", "status": "published", "summary": "Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack"}, {"advisory": "https://github.com/advisories/GHSA-6655-6qjp-jx7x", "aliases": ["CVE-2026-126191"], "commit": "https://github.com/github/advisory-database/commit/d7f40b238b018b57230354b3a98efb213aebefe4", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/d7f40b238b018b57230354b3a98efb213aebefe4/advisories/github-reviewed/2026/11/GHSA-6655-6qjp-jx7x/GHSA-6655-6qjp-jx7x.json", "id": "GHSA-6655-6qjp-jx7x", "packages": ["soupsieve"], "path": "advisories/github-reviewed/2026/11/GHSA-6655-6qjp-jx7x/GHSA-6655-6qjp-jx7x.json", "severity": "HIGH", "status": "published", "summary": "Soup Sieve: Exponential ReDoS in selector compilation via \\9-run in CSS_ESCAPES/IDENTIFIER"}, {"advisory": "https://github.com/advisories/GHSA-mf5v-w3w3-f6cg", "aliases": ["CVE-2026-126360"], "commit": "https://github.com/github/advisory-database/commit/cc2b7f626cffec0787b9717357a36f589225616e", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/cc2b7f626cffec0787b9717357a36f589225616e/advisories/github-reviewed/2026/11/GHSA-mf5v-w3w3-f6cg/GHSA-mf5v-w3w3-f6cg.json", "id": "GHSA-mf5v-w3w3-f6cg", "packages": ["opentelemetry-api"], "path": "advisories/github-reviewed/2026/11/GHSA-mf5v-w3w3-f6cg/GHSA-mf5v-w3w3-f6cg.json", "severity": "MODERATE", "status": "published", "summary": "OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing"}, {"advisory": "https://github.com/advisories/GHSA-cpgf-5mjf-73p7", "aliases": ["CVE-2026-128068"], "commit": "https://github.com/github/advisory-database/commit/8150ca091a4fb76146295fcc427e639a674ff72e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/8150ca091a4fb76146295fcc427e639a674ff72e/advisories/github-reviewed/2026/11/GHSA-cpgf-5mjf-73p7/GHSA-cpgf-5mjf-73p7.json", "id": "GHSA-cpgf-5mjf-73p7", "packages": ["rails-html-sanitizer"], "path": "advisories/github-reviewed/2026/11/GHSA-cpgf-5mjf-73p7/GHSA-cpgf-5mjf-73p7.json", "severity": "MODERATE", "status": "published", "summary": "rails-html-sanitizer: Possible regular expression denial of service with certain configurations"}, {"advisory": "https://github.com/advisories/GHSA-jv6m-48w5-5rpr", "aliases": ["CVE-2026-128079"], "commit": "https://github.com/github/advisory-database/commit/74d9b65c1cba9b1f9bf6fdb07a364d83ca7de25f", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/74d9b65c1cba9b1f9bf6fdb07a364d83ca7de25f/advisories/github-reviewed/2026/11/GHSA-jv6m-48w5-5rpr/GHSA-jv6m-48w5-5rpr.json", "id": "GHSA-jv6m-48w5-5rpr", "packages": ["envd"], "path": "advisories/github-reviewed/2026/11/GHSA-jv6m-48w5-5rpr/GHSA-jv6m-48w5-5rpr.json", "severity": "MODERATE", "status": "published", "summary": "envd: Host file disclosure through requirements path traversal and TOCTOU"}, {"advisory": "https://github.com/advisories/GHSA-h7wh-q2qr-458c", "aliases": ["CVE-2026-128069"], "commit": "https://github.com/github/advisory-database/commit/fd2c792c5ec3a2c514949d658e7c6078ac643f69", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/fd2c792c5ec3a2c514949d658e7c6078ac643f69/advisories/github-reviewed/2026/11/GHSA-h7wh-q2qr-458c/GHSA-h7wh-q2qr-458c.json", "id": "GHSA-h7wh-q2qr-458c", "packages": ["rails-html-sanitizer"], "path": "advisories/github-reviewed/2026/11/GHSA-h7wh-q2qr-458c/GHSA-h7wh-q2qr-458c.json", "severity": "MODERATE", "status": "published", "summary": "rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls"}, {"advisory": "https://github.com/advisories/GHSA-mjrq-cffv-q4qc", "aliases": ["CVE-2026-128070"], "commit": "https://github.com/github/advisory-database/commit/7a8ac86ae3359e59e5040b4bec62f6289138f79e", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7a8ac86ae3359e59e5040b4bec62f6289138f79e/advisories/github-reviewed/2026/11/GHSA-mjrq-cffv-q4qc/GHSA-mjrq-cffv-q4qc.json", "id": "GHSA-mjrq-cffv-q4qc", "packages": ["@nuxt/schema"], "path": "advisories/github-reviewed/2026/11/GHSA-mjrq-cffv-q4qc/GHSA-mjrq-cffv-q4qc.json", "severity": "MODERATE", "status": "published", "summary": "Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file"}, {"advisory": "https://github.com/advisories/GHSA-r3h5-4585-7x3w", "aliases": ["CVE-2026-126364"], "commit": "https://github.com/github/advisory-database/commit/1936c65b1508be11265709a09229d810010ab8fb", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1936c65b1508be11265709a09229d810010ab8fb/advisories/github-reviewed/2026/11/GHSA-r3h5-4585-7x3w/GHSA-r3h5-4585-7x3w.json", "id": "GHSA-r3h5-4585-7x3w", "packages": ["@astrojs/node", "astro"], "path": "advisories/github-reviewed/2026/11/GHSA-r3h5-4585-7x3w/GHSA-r3h5-4585-7x3w.json", "severity": "MODERATE", "status": "published", "summary": "Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems"}, {"advisory": "https://github.com/advisories/GHSA-mh32-jxcr-mh9f", "aliases": ["CVE-2026-126361"], "commit": "https://github.com/github/advisory-database/commit/e74debc9a3a735a867862dc0b19384d0c430fc8f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/e74debc9a3a735a867862dc0b19384d0c430fc8f/advisories/github-reviewed/2026/11/GHSA-mh32-jxcr-mh9f/GHSA-mh32-jxcr-mh9f.json", "id": "GHSA-mh32-jxcr-mh9f", "packages": ["astro"], "path": "advisories/github-reviewed/2026/11/GHSA-mh32-jxcr-mh9f/GHSA-mh32-jxcr-mh9f.json", "severity": "LOW", "status": "published", "summary": "Astro: XSS via attribute injection in dynamic tag names"}, {"advisory": "https://github.com/advisories/GHSA-gpwp-5797-mjff", "aliases": ["CVE-2026-128081"], "commit": "https://github.com/github/advisory-database/commit/364007edb49dabbc998eee1c6079f62c0155fbc9", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/364007edb49dabbc998eee1c6079f62c0155fbc9/advisories/github-reviewed/2026/11/GHSA-gpwp-5797-mjff/GHSA-gpwp-5797-mjff.json", "id": "GHSA-gpwp-5797-mjff", "packages": ["AutoMapper"], "path": "advisories/github-reviewed/2026/11/GHSA-gpwp-5797-mjff/GHSA-gpwp-5797-mjff.json", "severity": "HIGH", "status": "published", "summary": "AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth"}, {"advisory": "https://github.com/advisories/GHSA-63hm-g96r-2m2q", "aliases": ["CVE-2026-128083"], "commit": "https://github.com/github/advisory-database/commit/4ee9791db3416d33f863c149937addcfa972e8ee", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/4ee9791db3416d33f863c149937addcfa972e8ee/advisories/github-reviewed/2026/11/GHSA-63hm-g96r-2m2q/GHSA-63hm-g96r-2m2q.json", "id": "GHSA-63hm-g96r-2m2q", "packages": ["laravel/framework"], "path": "advisories/github-reviewed/2026/11/GHSA-63hm-g96r-2m2q/GHSA-63hm-g96r-2m2q.json", "severity": "LOW", "status": "published", "summary": "Laravel: Task Output Injection - Concurrency Process"}, {"advisory": "https://github.com/advisories/GHSA-4fqr-96q8-xrfx", "aliases": ["CVE-2026-128084"], "commit": "https://github.com/github/advisory-database/commit/c289804e665aac323c081789c7f137423efbdd24", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/c289804e665aac323c081789c7f137423efbdd24/advisories/github-reviewed/2026/11/GHSA-4fqr-96q8-xrfx/GHSA-4fqr-96q8-xrfx.json", "id": "GHSA-4fqr-96q8-xrfx", "packages": ["sqlite3"], "path": "advisories/github-reviewed/2026/11/GHSA-4fqr-96q8-xrfx/GHSA-4fqr-96q8-xrfx.json", "severity": "MODERATE", "status": "published", "summary": "sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger"}, {"advisory": "https://github.com/advisories/GHSA-q7gw-24fr-5p69", "aliases": ["CVE-2026-128085"], "commit": "https://github.com/github/advisory-database/commit/1eb06e7d63453b9fa0e56cdf15d2795cbb8fdcec", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/1eb06e7d63453b9fa0e56cdf15d2795cbb8fdcec/advisories/github-reviewed/2026/11/GHSA-q7gw-24fr-5p69/GHSA-q7gw-24fr-5p69.json", "id": "GHSA-q7gw-24fr-5p69", "packages": ["go.opentelemetry.io/otel/sdk", "go.opentelemetry.io/otel/sdk/log", "go.opentelemetry.io/otel/trace"], "path": "advisories/github-reviewed/2026/11/GHSA-q7gw-24fr-5p69/GHSA-q7gw-24fr-5p69.json", "severity": "MODERATE", "status": "published", "summary": "opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes"}, {"advisory": "https://github.com/advisories/GHSA-rrfc-gjm9-cgrj", "aliases": ["CVE-2026-128086"], "commit": "https://github.com/github/advisory-database/commit/1c957b7351b56ed8e37cccf75243b765150e0d93", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/1c957b7351b56ed8e37cccf75243b765150e0d93/advisories/github-reviewed/2026/11/GHSA-rrfc-gjm9-cgrj/GHSA-rrfc-gjm9-cgrj.json", "id": "GHSA-rrfc-gjm9-cgrj", "packages": ["go.opentelemetry.io/otel/baggage", "go.opentelemetry.io/otel/propagation"], "path": "advisories/github-reviewed/2026/11/GHSA-rrfc-gjm9-cgrj/GHSA-rrfc-gjm9-cgrj.json", "severity": "MODERATE", "status": "published", "summary": "OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification"}, {"advisory": "https://github.com/advisories/GHSA-736f-c93q-9fwx", "aliases": ["CVE-2026-128088"], "commit": "https://github.com/github/advisory-database/commit/8242cb021a02f0eb4608ee4ab878c3ab88b5a34e", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/8242cb021a02f0eb4608ee4ab878c3ab88b5a34e/advisories/github-reviewed/2026/11/GHSA-736f-c93q-9fwx/GHSA-736f-c93q-9fwx.json", "id": "GHSA-736f-c93q-9fwx", "packages": ["russh"], "path": "advisories/github-reviewed/2026/11/GHSA-736f-c93q-9fwx/GHSA-736f-c93q-9fwx.json", "severity": "LOW", "status": "published", "summary": "russh try_sign: asynchronous confirmation can sign after agent lock"}, {"advisory": "https://github.com/advisories/GHSA-9264-jvgf-6w2f", "aliases": ["CVE-2026-128087"], "commit": "https://github.com/github/advisory-database/commit/1878d81171e5bed193c1e7da4474ac280a7370ee", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/1878d81171e5bed193c1e7da4474ac280a7370ee/advisories/github-reviewed/2026/11/GHSA-9264-jvgf-6w2f/GHSA-9264-jvgf-6w2f.json", "id": "GHSA-9264-jvgf-6w2f", "packages": ["russh"], "path": "advisories/github-reviewed/2026/11/GHSA-9264-jvgf-6w2f/GHSA-9264-jvgf-6w2f.json", "severity": "LOW", "status": "published", "summary": "russh kex_done: Shared-secret callback runs before server host-key verification"}, {"advisory": "https://github.com/advisories/GHSA-6vhm-j9h7-f9gh", "aliases": ["CVE-2026-128082"], "commit": "https://github.com/github/advisory-database/commit/dc5824fa4e7cf15854abb24b8b912fbb1408c1ea", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/dc5824fa4e7cf15854abb24b8b912fbb1408c1ea/advisories/github-reviewed/2026/11/GHSA-6vhm-j9h7-f9gh/GHSA-6vhm-j9h7-f9gh.json", "id": "GHSA-6vhm-j9h7-f9gh", "packages": ["AutoMapper"], "path": "advisories/github-reviewed/2026/11/GHSA-6vhm-j9h7-f9gh/GHSA-6vhm-j9h7-f9gh.json", "severity": "HIGH", "status": "published", "summary": "AutoMapper: Uncontrolled Recursion with Constructor Parameters"}, {"advisory": "https://github.com/advisories/GHSA-3v2p-hm54-8qcq", "aliases": ["CVE-2026-128080"], "commit": "https://github.com/github/advisory-database/commit/2d0f959d94515f3ddcbd0ccddfa8ae21199d1cd8", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/2d0f959d94515f3ddcbd0ccddfa8ae21199d1cd8/advisories/github-reviewed/2026/11/GHSA-3v2p-hm54-8qcq/GHSA-3v2p-hm54-8qcq.json", "id": "GHSA-3v2p-hm54-8qcq", "packages": ["@opentelemetry/instrumentation-http"], "path": "advisories/github-reviewed/2026/11/GHSA-3v2p-hm54-8qcq/GHSA-3v2p-hm54-8qcq.json", "severity": "MODERATE", "status": "published", "summary": "OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http"}, {"advisory": "https://github.com/advisories/GHSA-r99w-jh2x-3mg9", "aliases": ["CVE-2026-128077"], "commit": "https://github.com/github/advisory-database/commit/23f11208c0d7dd60d67baf206f1b052aed30184f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/23f11208c0d7dd60d67baf206f1b052aed30184f/advisories/github-reviewed/2026/11/GHSA-r99w-jh2x-3mg9/GHSA-r99w-jh2x-3mg9.json", "id": "GHSA-r99w-jh2x-3mg9", "packages": ["@nuxt/nitro-server"], "path": "advisories/github-reviewed/2026/11/GHSA-r99w-jh2x-3mg9/GHSA-r99w-jh2x-3mg9.json", "severity": "MODERATE", "status": "published", "summary": "Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes"}, {"advisory": "https://github.com/advisories/GHSA-vvf4-9x63-8xvv", "aliases": ["CVE-2026-128089"], "commit": "https://github.com/github/advisory-database/commit/51afb096ea630f0fc668e7facbeee9c032207251", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/51afb096ea630f0fc668e7facbeee9c032207251/advisories/github-reviewed/2026/11/GHSA-vvf4-9x63-8xvv/GHSA-vvf4-9x63-8xvv.json", "id": "GHSA-vvf4-9x63-8xvv", "packages": ["dnspython"], "path": "advisories/github-reviewed/2026/11/GHSA-vvf4-9x63-8xvv/GHSA-vvf4-9x63-8xvv.json", "severity": "HIGH", "status": "published", "summary": "dnspython has excessive memory and CPU use"}, {"advisory": "https://github.com/advisories/GHSA-5cjw-f85j-cv6r", "aliases": ["CVE-2026-126347"], "commit": "https://github.com/github/advisory-database/commit/6cae5ca403c6f54030887cec6cef34f5c2c27843", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/6cae5ca403c6f54030887cec6cef34f5c2c27843/advisories/github-reviewed/2026/11/GHSA-5cjw-f85j-cv6r/GHSA-5cjw-f85j-cv6r.json", "id": "GHSA-5cjw-f85j-cv6r", "packages": ["tornado"], "path": "advisories/github-reviewed/2026/11/GHSA-5cjw-f85j-cv6r/GHSA-5cjw-f85j-cv6r.json", "severity": "LOW", "status": "published", "summary": "Tornado: Open redirect via triple-slash redirect paths"}, {"advisory": "https://github.com/advisories/GHSA-rqw3-x7hx-mm3p", "aliases": ["CVE-2026-128123"], "commit": "https://github.com/github/advisory-database/commit/8dd2303a59acd0de87df7b38e5c05eb68b4125d2", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/8dd2303a59acd0de87df7b38e5c05eb68b4125d2/advisories/github-reviewed/2026/11/GHSA-rqw3-x7hx-mm3p/GHSA-rqw3-x7hx-mm3p.json", "id": "GHSA-rqw3-x7hx-mm3p", "packages": ["@sveltejs/adapter-node"], "path": "advisories/github-reviewed/2026/11/GHSA-rqw3-x7hx-mm3p/GHSA-rqw3-x7hx-mm3p.json", "severity": "MODERATE", "status": "published", "summary": "SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`"}, {"advisory": "https://github.com/advisories/GHSA-5wg4-q3ww-283h", "aliases": ["CVE-2026-128122"], "commit": "https://github.com/github/advisory-database/commit/cebb49976e0b3ee817b35f66b4d2a5da2e544529", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/cebb49976e0b3ee817b35f66b4d2a5da2e544529/advisories/github-reviewed/2026/11/GHSA-5wg4-q3ww-283h/GHSA-5wg4-q3ww-283h.json", "id": "GHSA-5wg4-q3ww-283h", "packages": ["@sveltejs/adapter-cloudflare"], "path": "advisories/github-reviewed/2026/11/GHSA-5wg4-q3ww-283h/GHSA-5wg4-q3ww-283h.json", "severity": "MODERATE", "status": "published", "summary": "SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`"}, {"advisory": "https://github.com/advisories/GHSA-jf9x-2fg2-hx4w", "aliases": ["CVE-2026-128121"], "commit": "https://github.com/github/advisory-database/commit/75ac9f2cfb812c35e651671de1c5051aabc7d44c", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/75ac9f2cfb812c35e651671de1c5051aabc7d44c/advisories/github-reviewed/2026/11/GHSA-jf9x-2fg2-hx4w/GHSA-jf9x-2fg2-hx4w.json", "id": "GHSA-jf9x-2fg2-hx4w", "packages": ["@sveltejs/adapter-vercel", "@sveltejs/adapter-static"], "path": "advisories/github-reviewed/2026/11/GHSA-jf9x-2fg2-hx4w/GHSA-jf9x-2fg2-hx4w.json", "severity": "MODERATE", "status": "published", "summary": "SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static"}, {"advisory": "https://github.com/advisories/GHSA-mw6w-2fmv-pvw3", "aliases": ["CVE-2026-128117"], "commit": "https://github.com/github/advisory-database/commit/1f7ecfc45ad984725f5eb83b3e89f376e0c7620b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1f7ecfc45ad984725f5eb83b3e89f376e0c7620b/advisories/github-reviewed/2026/11/GHSA-mw6w-2fmv-pvw3/GHSA-mw6w-2fmv-pvw3.json", "id": "GHSA-mw6w-2fmv-pvw3", "packages": ["@sveltejs/kit"], "path": "advisories/github-reviewed/2026/11/GHSA-mw6w-2fmv-pvw3/GHSA-mw6w-2fmv-pvw3.json", "severity": "MODERATE", "status": "published", "summary": "SvelteKit: adapter-node crashes with an unhandled URIError when `reroute` rewrites malformed pathnames"}, {"advisory": "https://github.com/advisories/GHSA-7r4r-6ppg-7ff8", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/c22e8d90df91a2c839f9a6cc8a4cf6a62b23cd91", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/c22e8d90df91a2c839f9a6cc8a4cf6a62b23cd91/advisories/github-reviewed/2026/11/GHSA-7r4r-6ppg-7ff8/GHSA-7r4r-6ppg-7ff8.json", "id": "GHSA-7r4r-6ppg-7ff8", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-7r4r-6ppg-7ff8/GHSA-7r4r-6ppg-7ff8.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox"}, {"advisory": "https://github.com/advisories/GHSA-4hvg-fv5c-9936", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/407e74dc63e313f97227eca1c81414a5321500a4", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/407e74dc63e313f97227eca1c81414a5321500a4/advisories/github-reviewed/2026/11/GHSA-4hvg-fv5c-9936/GHSA-4hvg-fv5c-9936.json", "id": "GHSA-4hvg-fv5c-9936", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-4hvg-fv5c-9936/GHSA-4hvg-fv5c-9936.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Unbounded CPU consumption in NLTK SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars"}, {"advisory": "https://github.com/advisories/GHSA-qg35-44qx-7vrr", "aliases": ["CVE-2026-126304"], "commit": "https://github.com/github/advisory-database/commit/407e74dc63e313f97227eca1c81414a5321500a4", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/407e74dc63e313f97227eca1c81414a5321500a4/advisories/github-reviewed/2026/11/GHSA-qg35-44qx-7vrr/GHSA-qg35-44qx-7vrr.json", "id": "GHSA-qg35-44qx-7vrr", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-qg35-44qx-7vrr/GHSA-qg35-44qx-7vrr.json", "severity": "HIGH", "status": "published", "summary": "NLTK: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox"}, {"advisory": "https://github.com/advisories/GHSA-8fx7-8jr8-84rv", "aliases": ["CVE-2026-126303"], "commit": "https://github.com/github/advisory-database/commit/e2c68e60a557adcc8f075aae523046b9cf43232c", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/e2c68e60a557adcc8f075aae523046b9cf43232c/advisories/github-reviewed/2026/11/GHSA-8fx7-8jr8-84rv/GHSA-8fx7-8jr8-84rv.json", "id": "GHSA-8fx7-8jr8-84rv", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-8fx7-8jr8-84rv/GHSA-8fx7-8jr8-84rv.json", "severity": "HIGH", "status": "published", "summary": "NLTK: Unbounded CPU consumption in SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars"}, {"advisory": "https://github.com/advisories/GHSA-rg32-vgf9-927c", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/9162eba25b286e4a3da7c9e521d0368fa8212380", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/9162eba25b286e4a3da7c9e521d0368fa8212380/advisories/github-reviewed/2026/11/GHSA-rg32-vgf9-927c/GHSA-rg32-vgf9-927c.json", "id": "GHSA-rg32-vgf9-927c", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-rg32-vgf9-927c/GHSA-rg32-vgf9-927c.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop"}, {"advisory": "https://github.com/advisories/GHSA-ffr9-mgrr-wcvr", "aliases": ["CVE-2026-126300"], "commit": "https://github.com/github/advisory-database/commit/e1ecbd9ea5eb397b26514ffb0e463872e3e5e8d1", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/e1ecbd9ea5eb397b26514ffb0e463872e3e5e8d1/advisories/github-reviewed/2026/11/GHSA-ffr9-mgrr-wcvr/GHSA-ffr9-mgrr-wcvr.json", "id": "GHSA-ffr9-mgrr-wcvr", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-ffr9-mgrr-wcvr/GHSA-ffr9-mgrr-wcvr.json", "severity": "MODERATE", "status": "published", "summary": "NLTK: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop"}, {"advisory": "https://github.com/advisories/GHSA-gpwc-27cw-rh9r", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/96f64df1e8d2a1a4d3f7cf72e5c5a95a648fdfa1", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/96f64df1e8d2a1a4d3f7cf72e5c5a95a648fdfa1/advisories/github-reviewed/2026/11/GHSA-gpwc-27cw-rh9r/GHSA-gpwc-27cw-rh9r.json", "id": "GHSA-gpwc-27cw-rh9r", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-gpwc-27cw-rh9r/GHSA-gpwc-27cw-rh9r.json", "severity": "MODERATE", "status": "published", "summary": "NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop"}, {"advisory": "https://github.com/advisories/GHSA-g5wx-957h-f4wj", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/ad3f98cb12ad1c18dde899f31061ab667006429e", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ad3f98cb12ad1c18dde899f31061ab667006429e/advisories/github-reviewed/2026/11/GHSA-g5wx-957h-f4wj/GHSA-g5wx-957h-f4wj.json", "id": "GHSA-g5wx-957h-f4wj", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-g5wx-957h-f4wj/GHSA-g5wx-957h-f4wj.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: Path Traversal in save_maxent_params / load_maxent_params Allow Arbitrary File READ/WRITE"}, {"advisory": "https://github.com/advisories/GHSA-jh6r-h4rx-2j3w", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/ebf8894d236bef6d65a83096599b0bbad9083f50", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ebf8894d236bef6d65a83096599b0bbad9083f50/advisories/github-reviewed/2026/11/GHSA-jh6r-h4rx-2j3w/GHSA-jh6r-h4rx-2j3w.json", "id": "GHSA-jh6r-h4rx-2j3w", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-jh6r-h4rx-2j3w/GHSA-jh6r-h4rx-2j3w.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Quadratic-time CPU denial of service in NLTK CCG lexicon parser (fromstring) on wide bracket bodies and operator chains"}, {"advisory": "https://github.com/advisories/GHSA-pp88-jhwj-5qh5", "aliases": ["CVE-2026-62683"], "commit": "https://github.com/github/advisory-database/commit/8246cfea1e11d78f953467f626b2b208e946ca83", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/8246cfea1e11d78f953467f626b2b208e946ca83/advisories/github-reviewed/2026/11/GHSA-pp88-jhwj-5qh5/GHSA-pp88-jhwj-5qh5.json", "id": "GHSA-pp88-jhwj-5qh5", "packages": ["github.com/filebrowser/filebrowser/v2"], "path": "advisories/github-reviewed/2026/11/GHSA-pp88-jhwj-5qh5/GHSA-pp88-jhwj-5qh5.json", "severity": "LOW", "status": "published", "summary": "File Browser: Trailing-slash directory deletion leaves public shares active for recreated paths"}, {"advisory": "https://github.com/advisories/GHSA-qfx6-q44v-9qqw", "aliases": ["CVE-2026-62297"], "commit": "https://github.com/github/advisory-database/commit/63ef45dcf2b9da7d2c01b1906bf33273596fc4dd", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/63ef45dcf2b9da7d2c01b1906bf33273596fc4dd/advisories/github-reviewed/2026/11/GHSA-qfx6-q44v-9qqw/GHSA-qfx6-q44v-9qqw.json", "id": "GHSA-qfx6-q44v-9qqw", "packages": ["ag-psd"], "path": "advisories/github-reviewed/2026/11/GHSA-qfx6-q44v-9qqw/GHSA-qfx6-q44v-9qqw.json", "severity": "HIGH", "status": "published", "summary": "ag-psd can exhaust memory when parsing crafted PSD dimensions"}, {"advisory": "https://github.com/advisories/GHSA-f7j6-hf97-9v99", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/a58d110cf9790b728795f111c53bf68d64b0109a", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/a58d110cf9790b728795f111c53bf68d64b0109a/advisories/github-reviewed/2026/11/GHSA-f7j6-hf97-9v99/GHSA-f7j6-hf97-9v99.json", "id": "GHSA-f7j6-hf97-9v99", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-f7j6-hf97-9v99/GHSA-f7j6-hf97-9v99.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read"}, {"advisory": "https://github.com/advisories/GHSA-fg9w-wfp5-j933", "aliases": ["CVE-2026-126295"], "commit": "https://github.com/github/advisory-database/commit/a58d110cf9790b728795f111c53bf68d64b0109a", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/a58d110cf9790b728795f111c53bf68d64b0109a/advisories/github-reviewed/2026/11/GHSA-fg9w-wfp5-j933/GHSA-fg9w-wfp5-j933.json", "id": "GHSA-fg9w-wfp5-j933", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-fg9w-wfp5-j933/GHSA-fg9w-wfp5-j933.json", "severity": "MODERATE", "status": "published", "summary": "NLTK: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read"}], "sourceId": "advisories-reviewed", "text": "On November 13, 2026, GitHub's security advisory list published 41 new advisories, changed 2, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 30476, "fingerprint": "02ed468f5f46842bd8b974c3cd8fe0c23e32f9f8da917114e374247943ed1139", "url": "https://flarereef.flareforward.com/files/watch/02ed468f5f46842bd8b974c3cd8fe0c23e32f9f8da917114e374247943ed1139.json"}}}, "parsed": {"counts": {"changed": 2, "published": 41, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-13", "kind": "watch-day", "recordedAt": "2026-11-14T02:13:54Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-mfg3-p6m3-gjgr", "aliases": ["CVE-2026-46448"], "commit": "https://github.com/github/advisory-database/commit/afed71a60fe27fb31a448c718b922ba1883a8747", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/afed71a60fe27fb31a448c718b922ba1883a8747/advisories/github-reviewed/2026/06/GHSA-mfg3-p6m3-gjgr/GHSA-mfg3-p6m3-gjgr.json", "id": "GHSA-mfg3-p6m3-gjgr", "packages": ["nova"], "path": "advisories/github-reviewed/2026/06/GHSA-mfg3-p6m3-gjgr/GHSA-mfg3-p6m3-gjgr.json", "severity": "MODERATE", "status": "changed", "summary": "OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints"}, {"advisory": "https://github.com/advisories/GHSA-4j63-6c4x-wfg4", "aliases": ["CVE-2026-126192"], "commit": "https://github.com/github/advisory-database/commit/dd3621032506cd31b4606029323f9cc10e280ba1", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/dd3621032506cd31b4606029323f9cc10e280ba1/advisories/github-reviewed/2026/11/GHSA-4j63-6c4x-wfg4/GHSA-4j63-6c4x-wfg4.json", "id": "GHSA-4j63-6c4x-wfg4", "packages": ["soupsieve"], "path": "advisories/github-reviewed/2026/11/GHSA-4j63-6c4x-wfg4/GHSA-4j63-6c4x-wfg4.json", "severity": "MODERATE", "status": "published", "summary": "Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time"}, {"advisory": "https://github.com/advisories/GHSA-mmhr-3c5m-f64f", "aliases": ["CVE-2026-126190"], "commit": "https://github.com/github/advisory-database/commit/3bd657d41e18ea884042f635f43e3952435d2241", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3bd657d41e18ea884042f635f43e3952435d2241/advisories/github-reviewed/2026/11/GHSA-mmhr-3c5m-f64f/GHSA-mmhr-3c5m-f64f.json", "id": "GHSA-mmhr-3c5m-f64f", "packages": ["soupsieve"], "path": "advisories/github-reviewed/2026/11/GHSA-mmhr-3c5m-f64f/GHSA-mmhr-3c5m-f64f.json", "severity": "HIGH", "status": "published", "summary": "Soup Sieve: Polynomial-time denial of service in the descendant combinator"}, {"advisory": "https://github.com/advisories/GHSA-x585-4vv8-2mh2", "aliases": ["CVE-2026-100397"], "commit": "https://github.com/github/advisory-database/commit/6df69917e10740d3ac1b7bb4cb71ffcc5ea4e82b", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/6df69917e10740d3ac1b7bb4cb71ffcc5ea4e82b/advisories/github-reviewed/2026/11/GHSA-x585-4vv8-2mh2/GHSA-x585-4vv8-2mh2.json", "id": "GHSA-x585-4vv8-2mh2", "packages": ["rucio"], "path": "advisories/github-reviewed/2026/11/GHSA-x585-4vv8-2mh2/GHSA-x585-4vv8-2mh2.json", "severity": "CRITICAL", "status": "published", "summary": "Rucio: Unauthenticated administrator impersonation through SSH challenge tokens"}, {"advisory": "https://github.com/advisories/GHSA-v653-r55g-hcmg", "aliases": ["CVE-2025-13327"], "commit": "https://github.com/github/advisory-database/commit/be31a8d61d5d9e4c101caa4f7506105dda96862b", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/be31a8d61d5d9e4c101caa4f7506105dda96862b/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "id": "GHSA-v653-r55g-hcmg", "packages": ["uv"], "path": "advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "severity": "MODERATE", "status": "changed", "summary": "uv has ZIP payload obfuscation through parsing differentials"}, {"advisory": "https://github.com/advisories/GHSA-7g44-g9rc-x53w", "aliases": ["CVE-2026-126193"], "commit": "https://github.com/github/advisory-database/commit/d56a454765269424437dc69b51cc71da6a220842", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/d56a454765269424437dc69b51cc71da6a220842/advisories/github-reviewed/2026/11/GHSA-7g44-g9rc-x53w/GHSA-7g44-g9rc-x53w.json", "id": "GHSA-7g44-g9rc-x53w", "packages": ["soupsieve"], "path": "advisories/github-reviewed/2026/11/GHSA-7g44-g9rc-x53w/GHSA-7g44-g9rc-x53w.json", "severity": "MODERATE", "status": "published", "summary": "Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack"}, {"advisory": "https://github.com/advisories/GHSA-6655-6qjp-jx7x", "aliases": ["CVE-2026-126191"], "commit": "https://github.com/github/advisory-database/commit/d7f40b238b018b57230354b3a98efb213aebefe4", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/d7f40b238b018b57230354b3a98efb213aebefe4/advisories/github-reviewed/2026/11/GHSA-6655-6qjp-jx7x/GHSA-6655-6qjp-jx7x.json", "id": "GHSA-6655-6qjp-jx7x", "packages": ["soupsieve"], "path": "advisories/github-reviewed/2026/11/GHSA-6655-6qjp-jx7x/GHSA-6655-6qjp-jx7x.json", "severity": "HIGH", "status": "published", "summary": "Soup Sieve: Exponential ReDoS in selector compilation via \\9-run in CSS_ESCAPES/IDENTIFIER"}, {"advisory": "https://github.com/advisories/GHSA-mf5v-w3w3-f6cg", "aliases": ["CVE-2026-126360"], "commit": "https://github.com/github/advisory-database/commit/cc2b7f626cffec0787b9717357a36f589225616e", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/cc2b7f626cffec0787b9717357a36f589225616e/advisories/github-reviewed/2026/11/GHSA-mf5v-w3w3-f6cg/GHSA-mf5v-w3w3-f6cg.json", "id": "GHSA-mf5v-w3w3-f6cg", "packages": ["opentelemetry-api"], "path": "advisories/github-reviewed/2026/11/GHSA-mf5v-w3w3-f6cg/GHSA-mf5v-w3w3-f6cg.json", "severity": "MODERATE", "status": "published", "summary": "OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing"}, {"advisory": "https://github.com/advisories/GHSA-cpgf-5mjf-73p7", "aliases": ["CVE-2026-128068"], "commit": "https://github.com/github/advisory-database/commit/8150ca091a4fb76146295fcc427e639a674ff72e", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/8150ca091a4fb76146295fcc427e639a674ff72e/advisories/github-reviewed/2026/11/GHSA-cpgf-5mjf-73p7/GHSA-cpgf-5mjf-73p7.json", "id": "GHSA-cpgf-5mjf-73p7", "packages": ["rails-html-sanitizer"], "path": "advisories/github-reviewed/2026/11/GHSA-cpgf-5mjf-73p7/GHSA-cpgf-5mjf-73p7.json", "severity": "MODERATE", "status": "published", "summary": "rails-html-sanitizer: Possible regular expression denial of service with certain configurations"}, {"advisory": "https://github.com/advisories/GHSA-jv6m-48w5-5rpr", "aliases": ["CVE-2026-128079"], "commit": "https://github.com/github/advisory-database/commit/74d9b65c1cba9b1f9bf6fdb07a364d83ca7de25f", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/74d9b65c1cba9b1f9bf6fdb07a364d83ca7de25f/advisories/github-reviewed/2026/11/GHSA-jv6m-48w5-5rpr/GHSA-jv6m-48w5-5rpr.json", "id": "GHSA-jv6m-48w5-5rpr", "packages": ["envd"], "path": "advisories/github-reviewed/2026/11/GHSA-jv6m-48w5-5rpr/GHSA-jv6m-48w5-5rpr.json", "severity": "MODERATE", "status": "published", "summary": "envd: Host file disclosure through requirements path traversal and TOCTOU"}, {"advisory": "https://github.com/advisories/GHSA-h7wh-q2qr-458c", "aliases": ["CVE-2026-128069"], "commit": "https://github.com/github/advisory-database/commit/fd2c792c5ec3a2c514949d658e7c6078ac643f69", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/fd2c792c5ec3a2c514949d658e7c6078ac643f69/advisories/github-reviewed/2026/11/GHSA-h7wh-q2qr-458c/GHSA-h7wh-q2qr-458c.json", "id": "GHSA-h7wh-q2qr-458c", "packages": ["rails-html-sanitizer"], "path": "advisories/github-reviewed/2026/11/GHSA-h7wh-q2qr-458c/GHSA-h7wh-q2qr-458c.json", "severity": "MODERATE", "status": "published", "summary": "rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls"}, {"advisory": "https://github.com/advisories/GHSA-mjrq-cffv-q4qc", "aliases": ["CVE-2026-128070"], "commit": "https://github.com/github/advisory-database/commit/7a8ac86ae3359e59e5040b4bec62f6289138f79e", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7a8ac86ae3359e59e5040b4bec62f6289138f79e/advisories/github-reviewed/2026/11/GHSA-mjrq-cffv-q4qc/GHSA-mjrq-cffv-q4qc.json", "id": "GHSA-mjrq-cffv-q4qc", "packages": ["@nuxt/schema"], "path": "advisories/github-reviewed/2026/11/GHSA-mjrq-cffv-q4qc/GHSA-mjrq-cffv-q4qc.json", "severity": "MODERATE", "status": "published", "summary": "Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file"}, {"advisory": "https://github.com/advisories/GHSA-r3h5-4585-7x3w", "aliases": ["CVE-2026-126364"], "commit": "https://github.com/github/advisory-database/commit/1936c65b1508be11265709a09229d810010ab8fb", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1936c65b1508be11265709a09229d810010ab8fb/advisories/github-reviewed/2026/11/GHSA-r3h5-4585-7x3w/GHSA-r3h5-4585-7x3w.json", "id": "GHSA-r3h5-4585-7x3w", "packages": ["@astrojs/node", "astro"], "path": "advisories/github-reviewed/2026/11/GHSA-r3h5-4585-7x3w/GHSA-r3h5-4585-7x3w.json", "severity": "MODERATE", "status": "published", "summary": "Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems"}, {"advisory": "https://github.com/advisories/GHSA-mh32-jxcr-mh9f", "aliases": ["CVE-2026-126361"], "commit": "https://github.com/github/advisory-database/commit/e74debc9a3a735a867862dc0b19384d0c430fc8f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/e74debc9a3a735a867862dc0b19384d0c430fc8f/advisories/github-reviewed/2026/11/GHSA-mh32-jxcr-mh9f/GHSA-mh32-jxcr-mh9f.json", "id": "GHSA-mh32-jxcr-mh9f", "packages": ["astro"], "path": "advisories/github-reviewed/2026/11/GHSA-mh32-jxcr-mh9f/GHSA-mh32-jxcr-mh9f.json", "severity": "LOW", "status": "published", "summary": "Astro: XSS via attribute injection in dynamic tag names"}, {"advisory": "https://github.com/advisories/GHSA-gpwp-5797-mjff", "aliases": ["CVE-2026-128081"], "commit": "https://github.com/github/advisory-database/commit/364007edb49dabbc998eee1c6079f62c0155fbc9", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/364007edb49dabbc998eee1c6079f62c0155fbc9/advisories/github-reviewed/2026/11/GHSA-gpwp-5797-mjff/GHSA-gpwp-5797-mjff.json", "id": "GHSA-gpwp-5797-mjff", "packages": ["AutoMapper"], "path": "advisories/github-reviewed/2026/11/GHSA-gpwp-5797-mjff/GHSA-gpwp-5797-mjff.json", "severity": "HIGH", "status": "published", "summary": "AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth"}, {"advisory": "https://github.com/advisories/GHSA-63hm-g96r-2m2q", "aliases": ["CVE-2026-128083"], "commit": "https://github.com/github/advisory-database/commit/4ee9791db3416d33f863c149937addcfa972e8ee", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/4ee9791db3416d33f863c149937addcfa972e8ee/advisories/github-reviewed/2026/11/GHSA-63hm-g96r-2m2q/GHSA-63hm-g96r-2m2q.json", "id": "GHSA-63hm-g96r-2m2q", "packages": ["laravel/framework"], "path": "advisories/github-reviewed/2026/11/GHSA-63hm-g96r-2m2q/GHSA-63hm-g96r-2m2q.json", "severity": "LOW", "status": "published", "summary": "Laravel: Task Output Injection - Concurrency Process"}, {"advisory": "https://github.com/advisories/GHSA-4fqr-96q8-xrfx", "aliases": ["CVE-2026-128084"], "commit": "https://github.com/github/advisory-database/commit/c289804e665aac323c081789c7f137423efbdd24", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/c289804e665aac323c081789c7f137423efbdd24/advisories/github-reviewed/2026/11/GHSA-4fqr-96q8-xrfx/GHSA-4fqr-96q8-xrfx.json", "id": "GHSA-4fqr-96q8-xrfx", "packages": ["sqlite3"], "path": "advisories/github-reviewed/2026/11/GHSA-4fqr-96q8-xrfx/GHSA-4fqr-96q8-xrfx.json", "severity": "MODERATE", "status": "published", "summary": "sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger"}, {"advisory": "https://github.com/advisories/GHSA-q7gw-24fr-5p69", "aliases": ["CVE-2026-128085"], "commit": "https://github.com/github/advisory-database/commit/1eb06e7d63453b9fa0e56cdf15d2795cbb8fdcec", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/1eb06e7d63453b9fa0e56cdf15d2795cbb8fdcec/advisories/github-reviewed/2026/11/GHSA-q7gw-24fr-5p69/GHSA-q7gw-24fr-5p69.json", "id": "GHSA-q7gw-24fr-5p69", "packages": ["go.opentelemetry.io/otel/sdk", "go.opentelemetry.io/otel/sdk/log", "go.opentelemetry.io/otel/trace"], "path": "advisories/github-reviewed/2026/11/GHSA-q7gw-24fr-5p69/GHSA-q7gw-24fr-5p69.json", "severity": "MODERATE", "status": "published", "summary": "opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes"}, {"advisory": "https://github.com/advisories/GHSA-rrfc-gjm9-cgrj", "aliases": ["CVE-2026-128086"], "commit": "https://github.com/github/advisory-database/commit/1c957b7351b56ed8e37cccf75243b765150e0d93", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/1c957b7351b56ed8e37cccf75243b765150e0d93/advisories/github-reviewed/2026/11/GHSA-rrfc-gjm9-cgrj/GHSA-rrfc-gjm9-cgrj.json", "id": "GHSA-rrfc-gjm9-cgrj", "packages": ["go.opentelemetry.io/otel/baggage", "go.opentelemetry.io/otel/propagation"], "path": "advisories/github-reviewed/2026/11/GHSA-rrfc-gjm9-cgrj/GHSA-rrfc-gjm9-cgrj.json", "severity": "MODERATE", "status": "published", "summary": "OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification"}, {"advisory": "https://github.com/advisories/GHSA-736f-c93q-9fwx", "aliases": ["CVE-2026-128088"], "commit": "https://github.com/github/advisory-database/commit/8242cb021a02f0eb4608ee4ab878c3ab88b5a34e", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/8242cb021a02f0eb4608ee4ab878c3ab88b5a34e/advisories/github-reviewed/2026/11/GHSA-736f-c93q-9fwx/GHSA-736f-c93q-9fwx.json", "id": "GHSA-736f-c93q-9fwx", "packages": ["russh"], "path": "advisories/github-reviewed/2026/11/GHSA-736f-c93q-9fwx/GHSA-736f-c93q-9fwx.json", "severity": "LOW", "status": "published", "summary": "russh try_sign: asynchronous confirmation can sign after agent lock"}, {"advisory": "https://github.com/advisories/GHSA-9264-jvgf-6w2f", "aliases": ["CVE-2026-128087"], "commit": "https://github.com/github/advisory-database/commit/1878d81171e5bed193c1e7da4474ac280a7370ee", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/1878d81171e5bed193c1e7da4474ac280a7370ee/advisories/github-reviewed/2026/11/GHSA-9264-jvgf-6w2f/GHSA-9264-jvgf-6w2f.json", "id": "GHSA-9264-jvgf-6w2f", "packages": ["russh"], "path": "advisories/github-reviewed/2026/11/GHSA-9264-jvgf-6w2f/GHSA-9264-jvgf-6w2f.json", "severity": "LOW", "status": "published", "summary": "russh kex_done: Shared-secret callback runs before server host-key verification"}, {"advisory": "https://github.com/advisories/GHSA-6vhm-j9h7-f9gh", "aliases": ["CVE-2026-128082"], "commit": "https://github.com/github/advisory-database/commit/dc5824fa4e7cf15854abb24b8b912fbb1408c1ea", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/dc5824fa4e7cf15854abb24b8b912fbb1408c1ea/advisories/github-reviewed/2026/11/GHSA-6vhm-j9h7-f9gh/GHSA-6vhm-j9h7-f9gh.json", "id": "GHSA-6vhm-j9h7-f9gh", "packages": ["AutoMapper"], "path": "advisories/github-reviewed/2026/11/GHSA-6vhm-j9h7-f9gh/GHSA-6vhm-j9h7-f9gh.json", "severity": "HIGH", "status": "published", "summary": "AutoMapper: Uncontrolled Recursion with Constructor Parameters"}, {"advisory": "https://github.com/advisories/GHSA-3v2p-hm54-8qcq", "aliases": ["CVE-2026-128080"], "commit": "https://github.com/github/advisory-database/commit/2d0f959d94515f3ddcbd0ccddfa8ae21199d1cd8", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/2d0f959d94515f3ddcbd0ccddfa8ae21199d1cd8/advisories/github-reviewed/2026/11/GHSA-3v2p-hm54-8qcq/GHSA-3v2p-hm54-8qcq.json", "id": "GHSA-3v2p-hm54-8qcq", "packages": ["@opentelemetry/instrumentation-http"], "path": "advisories/github-reviewed/2026/11/GHSA-3v2p-hm54-8qcq/GHSA-3v2p-hm54-8qcq.json", "severity": "MODERATE", "status": "published", "summary": "OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http"}, {"advisory": "https://github.com/advisories/GHSA-r99w-jh2x-3mg9", "aliases": ["CVE-2026-128077"], "commit": "https://github.com/github/advisory-database/commit/23f11208c0d7dd60d67baf206f1b052aed30184f", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/23f11208c0d7dd60d67baf206f1b052aed30184f/advisories/github-reviewed/2026/11/GHSA-r99w-jh2x-3mg9/GHSA-r99w-jh2x-3mg9.json", "id": "GHSA-r99w-jh2x-3mg9", "packages": ["@nuxt/nitro-server"], "path": "advisories/github-reviewed/2026/11/GHSA-r99w-jh2x-3mg9/GHSA-r99w-jh2x-3mg9.json", "severity": "MODERATE", "status": "published", "summary": "Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes"}, {"advisory": "https://github.com/advisories/GHSA-vvf4-9x63-8xvv", "aliases": ["CVE-2026-128089"], "commit": "https://github.com/github/advisory-database/commit/51afb096ea630f0fc668e7facbeee9c032207251", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/51afb096ea630f0fc668e7facbeee9c032207251/advisories/github-reviewed/2026/11/GHSA-vvf4-9x63-8xvv/GHSA-vvf4-9x63-8xvv.json", "id": "GHSA-vvf4-9x63-8xvv", "packages": ["dnspython"], "path": "advisories/github-reviewed/2026/11/GHSA-vvf4-9x63-8xvv/GHSA-vvf4-9x63-8xvv.json", "severity": "HIGH", "status": "published", "summary": "dnspython has excessive memory and CPU use"}, {"advisory": "https://github.com/advisories/GHSA-5cjw-f85j-cv6r", "aliases": ["CVE-2026-126347"], "commit": "https://github.com/github/advisory-database/commit/6cae5ca403c6f54030887cec6cef34f5c2c27843", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/6cae5ca403c6f54030887cec6cef34f5c2c27843/advisories/github-reviewed/2026/11/GHSA-5cjw-f85j-cv6r/GHSA-5cjw-f85j-cv6r.json", "id": "GHSA-5cjw-f85j-cv6r", "packages": ["tornado"], "path": "advisories/github-reviewed/2026/11/GHSA-5cjw-f85j-cv6r/GHSA-5cjw-f85j-cv6r.json", "severity": "LOW", "status": "published", "summary": "Tornado: Open redirect via triple-slash redirect paths"}, {"advisory": "https://github.com/advisories/GHSA-rqw3-x7hx-mm3p", "aliases": ["CVE-2026-128123"], "commit": "https://github.com/github/advisory-database/commit/8dd2303a59acd0de87df7b38e5c05eb68b4125d2", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/8dd2303a59acd0de87df7b38e5c05eb68b4125d2/advisories/github-reviewed/2026/11/GHSA-rqw3-x7hx-mm3p/GHSA-rqw3-x7hx-mm3p.json", "id": "GHSA-rqw3-x7hx-mm3p", "packages": ["@sveltejs/adapter-node"], "path": "advisories/github-reviewed/2026/11/GHSA-rqw3-x7hx-mm3p/GHSA-rqw3-x7hx-mm3p.json", "severity": "MODERATE", "status": "published", "summary": "SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`"}, {"advisory": "https://github.com/advisories/GHSA-5wg4-q3ww-283h", "aliases": ["CVE-2026-128122"], "commit": "https://github.com/github/advisory-database/commit/cebb49976e0b3ee817b35f66b4d2a5da2e544529", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/cebb49976e0b3ee817b35f66b4d2a5da2e544529/advisories/github-reviewed/2026/11/GHSA-5wg4-q3ww-283h/GHSA-5wg4-q3ww-283h.json", "id": "GHSA-5wg4-q3ww-283h", "packages": ["@sveltejs/adapter-cloudflare"], "path": "advisories/github-reviewed/2026/11/GHSA-5wg4-q3ww-283h/GHSA-5wg4-q3ww-283h.json", "severity": "MODERATE", "status": "published", "summary": "SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`"}, {"advisory": "https://github.com/advisories/GHSA-jf9x-2fg2-hx4w", "aliases": ["CVE-2026-128121"], "commit": "https://github.com/github/advisory-database/commit/75ac9f2cfb812c35e651671de1c5051aabc7d44c", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/75ac9f2cfb812c35e651671de1c5051aabc7d44c/advisories/github-reviewed/2026/11/GHSA-jf9x-2fg2-hx4w/GHSA-jf9x-2fg2-hx4w.json", "id": "GHSA-jf9x-2fg2-hx4w", "packages": ["@sveltejs/adapter-vercel", "@sveltejs/adapter-static"], "path": "advisories/github-reviewed/2026/11/GHSA-jf9x-2fg2-hx4w/GHSA-jf9x-2fg2-hx4w.json", "severity": "MODERATE", "status": "published", "summary": "SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static"}, {"advisory": "https://github.com/advisories/GHSA-mw6w-2fmv-pvw3", "aliases": ["CVE-2026-128117"], "commit": "https://github.com/github/advisory-database/commit/1f7ecfc45ad984725f5eb83b3e89f376e0c7620b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1f7ecfc45ad984725f5eb83b3e89f376e0c7620b/advisories/github-reviewed/2026/11/GHSA-mw6w-2fmv-pvw3/GHSA-mw6w-2fmv-pvw3.json", "id": "GHSA-mw6w-2fmv-pvw3", "packages": ["@sveltejs/kit"], "path": "advisories/github-reviewed/2026/11/GHSA-mw6w-2fmv-pvw3/GHSA-mw6w-2fmv-pvw3.json", "severity": "MODERATE", "status": "published", "summary": "SvelteKit: adapter-node crashes with an unhandled URIError when `reroute` rewrites malformed pathnames"}, {"advisory": "https://github.com/advisories/GHSA-7r4r-6ppg-7ff8", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/c22e8d90df91a2c839f9a6cc8a4cf6a62b23cd91", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/c22e8d90df91a2c839f9a6cc8a4cf6a62b23cd91/advisories/github-reviewed/2026/11/GHSA-7r4r-6ppg-7ff8/GHSA-7r4r-6ppg-7ff8.json", "id": "GHSA-7r4r-6ppg-7ff8", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-7r4r-6ppg-7ff8/GHSA-7r4r-6ppg-7ff8.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox"}, {"advisory": "https://github.com/advisories/GHSA-4hvg-fv5c-9936", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/407e74dc63e313f97227eca1c81414a5321500a4", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/407e74dc63e313f97227eca1c81414a5321500a4/advisories/github-reviewed/2026/11/GHSA-4hvg-fv5c-9936/GHSA-4hvg-fv5c-9936.json", "id": "GHSA-4hvg-fv5c-9936", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-4hvg-fv5c-9936/GHSA-4hvg-fv5c-9936.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Unbounded CPU consumption in NLTK SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars"}, {"advisory": "https://github.com/advisories/GHSA-qg35-44qx-7vrr", "aliases": ["CVE-2026-126304"], "commit": "https://github.com/github/advisory-database/commit/407e74dc63e313f97227eca1c81414a5321500a4", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/407e74dc63e313f97227eca1c81414a5321500a4/advisories/github-reviewed/2026/11/GHSA-qg35-44qx-7vrr/GHSA-qg35-44qx-7vrr.json", "id": "GHSA-qg35-44qx-7vrr", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-qg35-44qx-7vrr/GHSA-qg35-44qx-7vrr.json", "severity": "HIGH", "status": "published", "summary": "NLTK: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox"}, {"advisory": "https://github.com/advisories/GHSA-8fx7-8jr8-84rv", "aliases": ["CVE-2026-126303"], "commit": "https://github.com/github/advisory-database/commit/e2c68e60a557adcc8f075aae523046b9cf43232c", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/e2c68e60a557adcc8f075aae523046b9cf43232c/advisories/github-reviewed/2026/11/GHSA-8fx7-8jr8-84rv/GHSA-8fx7-8jr8-84rv.json", "id": "GHSA-8fx7-8jr8-84rv", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-8fx7-8jr8-84rv/GHSA-8fx7-8jr8-84rv.json", "severity": "HIGH", "status": "published", "summary": "NLTK: Unbounded CPU consumption in SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars"}, {"advisory": "https://github.com/advisories/GHSA-rg32-vgf9-927c", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/9162eba25b286e4a3da7c9e521d0368fa8212380", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/9162eba25b286e4a3da7c9e521d0368fa8212380/advisories/github-reviewed/2026/11/GHSA-rg32-vgf9-927c/GHSA-rg32-vgf9-927c.json", "id": "GHSA-rg32-vgf9-927c", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-rg32-vgf9-927c/GHSA-rg32-vgf9-927c.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop"}, {"advisory": "https://github.com/advisories/GHSA-ffr9-mgrr-wcvr", "aliases": ["CVE-2026-126300"], "commit": "https://github.com/github/advisory-database/commit/e1ecbd9ea5eb397b26514ffb0e463872e3e5e8d1", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/e1ecbd9ea5eb397b26514ffb0e463872e3e5e8d1/advisories/github-reviewed/2026/11/GHSA-ffr9-mgrr-wcvr/GHSA-ffr9-mgrr-wcvr.json", "id": "GHSA-ffr9-mgrr-wcvr", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-ffr9-mgrr-wcvr/GHSA-ffr9-mgrr-wcvr.json", "severity": "MODERATE", "status": "published", "summary": "NLTK: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop"}, {"advisory": "https://github.com/advisories/GHSA-gpwc-27cw-rh9r", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/96f64df1e8d2a1a4d3f7cf72e5c5a95a648fdfa1", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/96f64df1e8d2a1a4d3f7cf72e5c5a95a648fdfa1/advisories/github-reviewed/2026/11/GHSA-gpwc-27cw-rh9r/GHSA-gpwc-27cw-rh9r.json", "id": "GHSA-gpwc-27cw-rh9r", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-gpwc-27cw-rh9r/GHSA-gpwc-27cw-rh9r.json", "severity": "MODERATE", "status": "published", "summary": "NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop"}, {"advisory": "https://github.com/advisories/GHSA-g5wx-957h-f4wj", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/ad3f98cb12ad1c18dde899f31061ab667006429e", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ad3f98cb12ad1c18dde899f31061ab667006429e/advisories/github-reviewed/2026/11/GHSA-g5wx-957h-f4wj/GHSA-g5wx-957h-f4wj.json", "id": "GHSA-g5wx-957h-f4wj", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-g5wx-957h-f4wj/GHSA-g5wx-957h-f4wj.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: Path Traversal in save_maxent_params / load_maxent_params Allow Arbitrary File READ/WRITE"}, {"advisory": "https://github.com/advisories/GHSA-jh6r-h4rx-2j3w", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/ebf8894d236bef6d65a83096599b0bbad9083f50", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/ebf8894d236bef6d65a83096599b0bbad9083f50/advisories/github-reviewed/2026/11/GHSA-jh6r-h4rx-2j3w/GHSA-jh6r-h4rx-2j3w.json", "id": "GHSA-jh6r-h4rx-2j3w", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-jh6r-h4rx-2j3w/GHSA-jh6r-h4rx-2j3w.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Quadratic-time CPU denial of service in NLTK CCG lexicon parser (fromstring) on wide bracket bodies and operator chains"}, {"advisory": "https://github.com/advisories/GHSA-pp88-jhwj-5qh5", "aliases": ["CVE-2026-62683"], "commit": "https://github.com/github/advisory-database/commit/8246cfea1e11d78f953467f626b2b208e946ca83", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/8246cfea1e11d78f953467f626b2b208e946ca83/advisories/github-reviewed/2026/11/GHSA-pp88-jhwj-5qh5/GHSA-pp88-jhwj-5qh5.json", "id": "GHSA-pp88-jhwj-5qh5", "packages": ["github.com/filebrowser/filebrowser/v2"], "path": "advisories/github-reviewed/2026/11/GHSA-pp88-jhwj-5qh5/GHSA-pp88-jhwj-5qh5.json", "severity": "LOW", "status": "published", "summary": "File Browser: Trailing-slash directory deletion leaves public shares active for recreated paths"}, {"advisory": "https://github.com/advisories/GHSA-qfx6-q44v-9qqw", "aliases": ["CVE-2026-62297"], "commit": "https://github.com/github/advisory-database/commit/63ef45dcf2b9da7d2c01b1906bf33273596fc4dd", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/63ef45dcf2b9da7d2c01b1906bf33273596fc4dd/advisories/github-reviewed/2026/11/GHSA-qfx6-q44v-9qqw/GHSA-qfx6-q44v-9qqw.json", "id": "GHSA-qfx6-q44v-9qqw", "packages": ["ag-psd"], "path": "advisories/github-reviewed/2026/11/GHSA-qfx6-q44v-9qqw/GHSA-qfx6-q44v-9qqw.json", "severity": "HIGH", "status": "published", "summary": "ag-psd can exhaust memory when parsing crafted PSD dimensions"}, {"advisory": "https://github.com/advisories/GHSA-f7j6-hf97-9v99", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/a58d110cf9790b728795f111c53bf68d64b0109a", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/a58d110cf9790b728795f111c53bf68d64b0109a/advisories/github-reviewed/2026/11/GHSA-f7j6-hf97-9v99/GHSA-f7j6-hf97-9v99.json", "id": "GHSA-f7j6-hf97-9v99", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-f7j6-hf97-9v99/GHSA-f7j6-hf97-9v99.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read"}, {"advisory": "https://github.com/advisories/GHSA-fg9w-wfp5-j933", "aliases": ["CVE-2026-126295"], "commit": "https://github.com/github/advisory-database/commit/a58d110cf9790b728795f111c53bf68d64b0109a", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/a58d110cf9790b728795f111c53bf68d64b0109a/advisories/github-reviewed/2026/11/GHSA-fg9w-wfp5-j933/GHSA-fg9w-wfp5-j933.json", "id": "GHSA-fg9w-wfp5-j933", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/11/GHSA-fg9w-wfp5-j933/GHSA-fg9w-wfp5-j933.json", "severity": "MODERATE", "status": "published", "summary": "NLTK: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read"}], "sourceId": "advisories-reviewed", "text": "On November 13, 2026, GitHub's security advisory list published 41 new advisories, changed 2, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 30476, "fingerprint": "02ed468f5f46842bd8b974c3cd8fe0c23e32f9f8da917114e374247943ed1139", "url": "https://flarereef.flareforward.com/files/watch/02ed468f5f46842bd8b974c3cd8fe0c23e32f9f8da917114e374247943ed1139.json"}}, "project": {"projectId": 20, "name": "Security advisories (GitHub reviewed)", "kind": "watch", "keeper": "GitHub", "jurisdiction": "", "markText": "GH", "shape": "", "what": "GitHub's security advisory list", "repoUrl": "https://github.com/github/advisory-database", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "chunk": "day"}, "date": "2026-11-14", "author": {"name": "Flare Reef watcher", "handle": "", "verified": false}}