{"project": {"projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "network": "watch", "kind": "watch", "chainId": 0, "subject": "github/advisory-database/reviewed", "name": "Security advisories (GitHub reviewed)", "fingerprint": "0x47cae739c6976fd0047fdf8cc367ef32c66c10e1d689681bea5e1ff67bd44b7b", "content": "{\"chunk\":\"day\",\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"keeper\":\"GitHub\",\"kind\":\"record\",\"markText\":\"GH\",\"name\":\"Security advisories (GitHub reviewed)\",\"network\":\"watch\",\"repoUrl\":\"https://github.com/github/advisory-database\",\"sourceId\":\"advisories-reviewed\",\"subject\":\"github/advisory-database/reviewed\",\"v\":1,\"what\":\"GitHub's security advisory list\"}", "txHash": "0x66b839c0e3c365a740735c72d46131ff452ec5abdfd2fac7e2e0ffd04da266da", "receiptUrl": "https://flare-explorer.flare.network/tx/0x66b839c0e3c365a740735c72d46131ff452ec5abdfd2fac7e2e0ffd04da266da", "blockNumber": 73418270, "jurisdiction": "", "markText": "GH", "shape": "", "keeper": "GitHub", "what": "GitHub's security advisory list", "repoUrl": "https://github.com/github/advisory-database", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "chunk": "day"}, "notes": [{"noteId": 208, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0xee46e33b0281fca18b1a372cbf89c50b0ef3b166620c1f826fa0957e8301d7a2", "content": "{\"kind\":\"watch-record\",\"receipts\":[{\"label\":\"Keeper's history\",\"url\":\"https://github.com/github/advisory-database\"}],\"recordedAt\":\"2026-10-31T14:55:28Z\",\"sourceId\":\"advisories-reviewed\",\"text\":\"First check recorded on October 31, 2026. This record follows GitHub's security advisory list, kept by GitHub at https://github.com/github/advisory-database. Changes before this day are in that history.\",\"v\":1}", "structured": null, "uri": "", "txHash": "0xc228ad3cc6ef4607607bdcd16b8d7b4d675cf3c40fcfe3ad294d03324ce9859f", "receiptUrl": "https://flare-explorer.flare.network/tx/0xc228ad3cc6ef4607607bdcd16b8d7b4d675cf3c40fcfe3ad294d03324ce9859f", "blockNumber": 73418272, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": []}, {"noteId": 209, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0x83491a3dd9a1252543f3a715e1eed07f86c84055d0dc0c54b33de613f8123140", "content": "{\"counts\":{\"changed\":0,\"published\":0,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-10-30\",\"kind\":\"watch-day\",\"recordedAt\":\"2026-10-31T15:30:31Z\",\"rows\":[],\"sourceId\":\"advisories-reviewed\",\"text\":\"On October 30, 2026, GitHub's security advisory list published 0 new advisories, changed 0, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "", "txHash": "0xbb86b8496723698c22a69a4c7f47f5bb42c8f542da674bffbd34d1b64eeb7ba6", "receiptUrl": "https://flare-explorer.flare.network/tx/0xbb86b8496723698c22a69a4c7f47f5bb42c8f542da674bffbd34d1b64eeb7ba6", "blockNumber": 73420140, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": []}, {"noteId": 212, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0xc15b206bd831057321d01796dfdfd8a00f43a111c808d8000b35af921ea0e17b", "content": "{\"counts\":{\"changed\":0,\"published\":0,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-10-31\",\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-01T00:49:20Z\",\"rows\":[],\"sourceId\":\"advisories-reviewed\",\"text\":\"On October 31, 2026, GitHub's security advisory list published 0 new advisories, changed 0, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "", "txHash": "0xe7c078b70f35a9b683297cd740b2eb75d50e2f40243698379e501b01400601c2", "receiptUrl": "https://flare-explorer.flare.network/tx/0xe7c078b70f35a9b683297cd740b2eb75d50e2f40243698379e501b01400601c2", "blockNumber": 73450483, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": []}, {"noteId": 262, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0xc9ac359e1012106d0223d05c191854126cd45a8b2e5b09182ddf940e10bd2f9d", "content": "{\"counts\":{\"changed\":0,\"published\":0,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-01\",\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-02T01:29:12Z\",\"rows\":[],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 1, 2026, GitHub's security advisory list published 0 new advisories, changed 0, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "", "txHash": "0x9a90b716cd0e4a1381d2b7fed63775e4184268c67ce43843a610085733cd003c", "receiptUrl": "https://flare-explorer.flare.network/tx/0x9a90b716cd0e4a1381d2b7fed63775e4184268c67ce43843a610085733cd003c", "blockNumber": 73531403, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": []}, {"noteId": 357, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0xf4085bb7e31c3abc6bb9478a300719b26cad3e8d801595275ba684fb26266661", "content": "{\"counts\":{\"changed\":16,\"published\":2,\"removed\":0,\"withdrawn\":0},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-02\",\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-03T01:01:39Z\",\"rows\":[{\"advisory\":\"https://github.com/advisories/GHSA-f9j6-8p6x-r9j6\",\"aliases\":[\"CVE-2026-62374\"],\"commit\":\"https://github.com/github/advisory-database/commit/714474ad30864fbfc71ec0cefc1a454bb23763f9\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/714474ad30864fbfc71ec0cefc1a454bb23763f9/advisories/github-reviewed/2026/11/GHSA-f9j6-8p6x-r9j6/GHSA-f9j6-8p6x-r9j6.json\",\"id\":\"GHSA-f9j6-8p6x-r9j6\",\"packages\":[\"@sd-jwt/decode\",\"@sd-jwt/core\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-f9j6-8p6x-r9j6/GHSA-f9j6-8p6x-r9j6.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"SD JWT JS: Tampered disclosures silently dropped instead of rejected\"},{\"advisory\":\"https://github.com/advisories/GHSA-j656-3hf2-fvjc\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c/advisories/github-reviewed/2026/11/GHSA-j656-3hf2-fvjc/GHSA-j656-3hf2-fvjc.json\",\"id\":\"GHSA-j656-3hf2-fvjc\",\"packages\":[\"@bytebase/dbhub\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-j656-3hf2-fvjc/GHSA-j656-3hf2-fvjc.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation\"},{\"advisory\":\"https://github.com/advisories/GHSA-593v-wcqx-hq2w\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/fc5d42155fec5ec1d99600e0116af511fb281c9d\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/fc5d42155fec5ec1d99600e0116af511fb281c9d/advisories/github-reviewed/2021/09/GHSA-593v-wcqx-hq2w/GHSA-593v-wcqx-hq2w.json\",\"id\":\"GHSA-593v-wcqx-hq2w\",\"packages\":[\"parse-server\"],\"path\":\"advisories/github-reviewed/2021/09/GHSA-593v-wcqx-hq2w/GHSA-593v-wcqx-hq2w.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Incorrect version tags linked to external repository\"},{\"advisory\":\"https://github.com/advisories/GHSA-62gx-5q78-wrvx\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/1d4cd95343cec306ca25af2ff701101a186a82a7\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/1d4cd95343cec306ca25af2ff701101a186a82a7/advisories/github-reviewed/2026/07/GHSA-62gx-5q78-wrvx/GHSA-62gx-5q78-wrvx.json\",\"id\":\"GHSA-62gx-5q78-wrvx\",\"packages\":[\"obsidian-local-rest-api\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-62gx-5q78-wrvx/GHSA-62gx-5q78-wrvx.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} \u2014 arbitrary host file read/write/delete\"},{\"advisory\":\"https://github.com/advisories/GHSA-wcjj-9m6g-2fr2\",\"aliases\":[\"CVE-2026-59176\"],\"commit\":\"https://github.com/github/advisory-database/commit/c99b68a106442b6fa5d954af56dd58c59c4e8617\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/c99b68a106442b6fa5d954af56dd58c59c4e8617/advisories/github-reviewed/2026/09/GHSA-wcjj-9m6g-2fr2/GHSA-wcjj-9m6g-2fr2.json\",\"id\":\"GHSA-wcjj-9m6g-2fr2\",\"packages\":[\"functype-mcp-server\"],\"path\":\"advisories/github-reviewed/2026/09/GHSA-wcjj-9m6g-2fr2/GHSA-wcjj-9m6g-2fr2.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import\"},{\"advisory\":\"https://github.com/advisories/GHSA-2x63-gw47-w4mm\",\"aliases\":[\"CVE-2026-61666\"],\"commit\":\"https://github.com/github/advisory-database/commit/b5542e1d1ef8751817ac573f83d4433c852ede80\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/b5542e1d1ef8751817ac573f83d4433c852ede80/advisories/github-reviewed/2026/07/GHSA-2x63-gw47-w4mm/GHSA-2x63-gw47-w4mm.json\",\"id\":\"GHSA-2x63-gw47-w4mm\",\"packages\":[\"websocket-driver\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-2x63-gw47-w4mm/GHSA-2x63-gw47-w4mm.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"websocket-driver-ruby: Denial of service via malformed Host header\"},{\"advisory\":\"https://github.com/advisories/GHSA-crwc-vw2r-qr6m\",\"aliases\":[\"CVE-2026-113730\"],\"commit\":\"https://github.com/github/advisory-database/commit/1e24e5f4b872224ded9288b412cea0b5957cdb5e\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/1e24e5f4b872224ded9288b412cea0b5957cdb5e/advisories/github-reviewed/2026/10/GHSA-crwc-vw2r-qr6m/GHSA-crwc-vw2r-qr6m.json\",\"id\":\"GHSA-crwc-vw2r-qr6m\",\"packages\":[\"ognl:ognl\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-crwc-vw2r-qr6m/GHSA-crwc-vw2r-qr6m.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies\"},{\"advisory\":\"https://github.com/advisories/GHSA-8mgp-746c-j5xp\",\"aliases\":[\"CVE-2026-81726\"],\"commit\":\"https://github.com/github/advisory-database/commit/fc9a22d2ae88d6a10dda69215596c9400648ba9e\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/fc9a22d2ae88d6a10dda69215596c9400648ba9e/advisories/github-reviewed/2026/09/GHSA-8mgp-746c-j5xp/GHSA-8mgp-746c-j5xp.json\",\"id\":\"GHSA-8mgp-746c-j5xp\",\"packages\":[\"nltk\"],\"path\":\"advisories/github-reviewed/2026/09/GHSA-8mgp-746c-j5xp/GHSA-8mgp-746c-j5xp.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots\"},{\"advisory\":\"https://github.com/advisories/GHSA-2vqw-3mp8-cgmx\",\"aliases\":[\"CVE-2026-47737\"],\"commit\":\"https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-2vqw-3mp8-cgmx/GHSA-2vqw-3mp8-cgmx.json\",\"id\":\"GHSA-2vqw-3mp8-cgmx\",\"packages\":[\"puma\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-2vqw-3mp8-cgmx/GHSA-2vqw-3mp8-cgmx.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections\"},{\"advisory\":\"https://github.com/advisories/GHSA-qpgp-93vx-g8v8\",\"aliases\":[\"CVE-2026-47736\"],\"commit\":\"https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3\",\"ecosystems\":[\"RubyGems\"],\"file\":\"https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-qpgp-93vx-g8v8/GHSA-qpgp-93vx-g8v8.json\",\"id\":\"GHSA-qpgp-93vx-g8v8\",\"packages\":[\"puma\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-qpgp-93vx-g8v8/GHSA-qpgp-93vx-g8v8.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion \"},{\"advisory\":\"https://github.com/advisories/GHSA-gm2x-2g9h-ccm8\",\"aliases\":[\"CVE-2026-33762\"],\"commit\":\"https://github.com/github/advisory-database/commit/cde59b3a8eabd10e036a1898a338bd463ae26b06\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/cde59b3a8eabd10e036a1898a338bd463ae26b06/advisories/github-reviewed/2026/03/GHSA-gm2x-2g9h-ccm8/GHSA-gm2x-2g9h-ccm8.json\",\"id\":\"GHSA-gm2x-2g9h-ccm8\",\"packages\":[\"github.com/go-git/go-git/v5\"],\"path\":\"advisories/github-reviewed/2026/03/GHSA-gm2x-2g9h-ccm8/GHSA-gm2x-2g9h-ccm8.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"go-git missing validation decoding Index v4 files leads to panic\"},{\"advisory\":\"https://github.com/advisories/GHSA-79qf-vqgc-7xx3\",\"aliases\":[\"CVE-2026-63667\"],\"commit\":\"https://github.com/github/advisory-database/commit/bf47def862a58277316e0fb670b9da02328bea6b\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/bf47def862a58277316e0fb670b9da02328bea6b/advisories/github-reviewed/2026/09/GHSA-79qf-vqgc-7xx3/GHSA-79qf-vqgc-7xx3.json\",\"id\":\"GHSA-79qf-vqgc-7xx3\",\"packages\":[\"@apostrophecms/import-export\"],\"path\":\"advisories/github-reviewed/2026/09/GHSA-79qf-vqgc-7xx3/GHSA-79qf-vqgc-7xx3.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal\"},{\"advisory\":\"https://github.com/advisories/GHSA-wg36-wvj6-r67p\",\"aliases\":[\"CVE-2026-40176\"],\"commit\":\"https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/04/GHSA-wg36-wvj6-r67p/GHSA-wg36-wvj6-r67p.json\",\"id\":\"GHSA-wg36-wvj6-r67p\",\"packages\":[\"composer/composer\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-wg36-wvj6-r67p/GHSA-wg36-wvj6-r67p.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Composer has a command injection via malicious perforce repository\"},{\"advisory\":\"https://github.com/advisories/GHSA-2p5x-4jr6-x5jg\",\"aliases\":[\"CVE-2026-45263\"],\"commit\":\"https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-2p5x-4jr6-x5jg/GHSA-2p5x-4jr6-x5jg.json\",\"id\":\"GHSA-2p5x-4jr6-x5jg\",\"packages\":[\"facturascripts/facturascripts\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-2p5x-4jr6-x5jg/GHSA-2p5x-4jr6-x5jg.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export\"},{\"advisory\":\"https://github.com/advisories/GHSA-5qmh-x653-g8qj\",\"aliases\":[\"CVE-2026-45262\"],\"commit\":\"https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-5qmh-x653-g8qj/GHSA-5qmh-x653-g8qj.json\",\"id\":\"GHSA-5qmh-x653-g8qj\",\"packages\":[\"facturascripts/facturascripts\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-5qmh-x653-g8qj/GHSA-5qmh-x653-g8qj.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`\"},{\"advisory\":\"https://github.com/advisories/GHSA-hgjx-r89m-m7v4\",\"aliases\":[\"CVE-2026-77526\"],\"commit\":\"https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-hgjx-r89m-m7v4/GHSA-hgjx-r89m-m7v4.json\",\"id\":\"GHSA-hgjx-r89m-m7v4\",\"packages\":[\"facturascripts/facturascripts\"],\"path\":\"advisories/github-reviewed/2026/07/GHSA-hgjx-r89m-m7v4/GHSA-hgjx-r89m-m7v4.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() \u2014 arbitrary file write outside MyFiles/ leading to   RCE\"},{\"advisory\":\"https://github.com/advisories/GHSA-6hcw-qqr8-pjj8\",\"aliases\":[\"CVE-2026-40961\"],\"commit\":\"https://github.com/github/advisory-database/commit/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964/advisories/github-reviewed/2026/06/GHSA-6hcw-qqr8-pjj8/GHSA-6hcw-qqr8-pjj8.json\",\"id\":\"GHSA-6hcw-qqr8-pjj8\",\"packages\":[\"apache-airflow\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-6hcw-qqr8-pjj8/GHSA-6hcw-qqr8-pjj8.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Apache Airflow: Authenticated users can bypass the `is_safe_url` check\"},{\"advisory\":\"https://github.com/advisories/GHSA-r4q5-vmmm-2653\",\"aliases\":[\"CVE-2026-40895\"],\"commit\":\"https://github.com/github/advisory-database/commit/5dc5b0acd7f8e64312f23715f299fee0e0b92710\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/5dc5b0acd7f8e64312f23715f299fee0e0b92710/advisories/github-reviewed/2026/04/GHSA-r4q5-vmmm-2653/GHSA-r4q5-vmmm-2653.json\",\"id\":\"GHSA-r4q5-vmmm-2653\",\"packages\":[\"follow-redirects\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-r4q5-vmmm-2653/GHSA-r4q5-vmmm-2653.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets\"}],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 2, 2026, GitHub's security advisory list published 2 new advisories, changed 16, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "", "txHash": "0xbe7125794b53b6deca06ad524b615bff78676ec8ec00feac4b9eb8e5e017d9d3", "receiptUrl": "https://flare-explorer.flare.network/tx/0xbe7125794b53b6deca06ad524b615bff78676ec8ec00feac4b9eb8e5e017d9d3", "blockNumber": 73609129, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": []}, {"noteId": 418, "projectId": 20, "author": "0xbf9fe7767f57780b106756fcd22dfe53394eb81c", "authorName": "0xbf9f...b81c", "authorHandle": null, "authorVerified": false, "authorShort": "0xbf9f...b81c", "source": "reef", "status": "", "alsoReports": 0, "separateFrom": 0, "kind": 3, "kindLabel": "context", "inReplyTo": 0, "fingerprint": "0xa18511b6f0003f52059d55643c009de6c90a0c4ecb5b86445a968b14a3920d30", "content": "{\"counts\":{\"changed\":29,\"published\":22,\"removed\":0,\"withdrawn\":1},\"credit\":\"Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.\",\"day\":\"2026-11-03\",\"fullList\":{\"bytes\":40531,\"fingerprint\":\"59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc\",\"url\":\"https://flarereef.flareforward.com/files/watch/59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc.json\"},\"kind\":\"watch-day\",\"recordedAt\":\"2026-11-04T02:17:13Z\",\"rows\":[{\"advisory\":\"https://github.com/advisories/GHSA-wp3j-xq48-xpjw\",\"aliases\":[\"CVE-2025-9566\"],\"commit\":\"https://github.com/github/advisory-database/commit/887dcb68f13a7d9be8bf3d604c2e32fc3d6960e8\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/887dcb68f13a7d9be8bf3d604c2e32fc3d6960e8/advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json\",\"id\":\"GHSA-wp3j-xq48-xpjw\",\"packages\":[\"github.com/containers/podman/v5\",\"github.com/containers/podman/v4\"],\"path\":\"advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"podman kube play symlink traversal vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-v653-r55g-hcmg\",\"aliases\":[\"CVE-2025-13327\"],\"commit\":\"https://github.com/github/advisory-database/commit/109512409477d1b7dfa372b0346a28a59d47e04d\",\"ecosystems\":[\"crates.io\"],\"file\":\"https://github.com/github/advisory-database/blob/109512409477d1b7dfa372b0346a28a59d47e04d/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json\",\"id\":\"GHSA-v653-r55g-hcmg\",\"packages\":[\"uv\"],\"path\":\"advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"uv has ZIP payload obfuscation through parsing differentials\"},{\"advisory\":\"https://github.com/advisories/GHSA-f23m-r3pf-42rh\",\"aliases\":[\"CVE-2026-2950\"],\"commit\":\"https://github.com/github/advisory-database/commit/0b1941f7d05b03f4ed6469b0236dd3c59357f497\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/0b1941f7d05b03f4ed6469b0236dd3c59357f497/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json\",\"id\":\"GHSA-f23m-r3pf-42rh\",\"packages\":[\"lodash\",\"lodash-es\",\"lodash-amd\",\"lodash.unset\",\"lodash.omit\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt\"},{\"advisory\":\"https://github.com/advisories/GHSA-2cvf-wqm6-wr9g\",\"aliases\":[\"CVE-2026-94603\"],\"commit\":\"https://github.com/github/advisory-database/commit/b9d5dfa2061837f892e2cdbecfe33751bcd902fa\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/b9d5dfa2061837f892e2cdbecfe33751bcd902fa/advisories/github-reviewed/2026/10/GHSA-2cvf-wqm6-wr9g/GHSA-2cvf-wqm6-wr9g.json\",\"id\":\"GHSA-2cvf-wqm6-wr9g\",\"packages\":[\"github.com/containers/podman/v4\",\"go.podman.io/podman/v6\",\"github.com/containers/podman/v5\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-2cvf-wqm6-wr9g/GHSA-2cvf-wqm6-wr9g.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation\"},{\"advisory\":\"https://github.com/advisories/GHSA-23f4-hfmq-94mj\",\"aliases\":[\"CVE-2026-24807\"],\"commit\":\"https://github.com/github/advisory-database/commit/1cd5f193871f6f187dcd0bb684096313535d13dc\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/1cd5f193871f6f187dcd0bb684096313535d13dc/advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json\",\"id\":\"GHSA-23f4-hfmq-94mj\",\"packages\":[\"com.github.liuyueyi.media:batik-codec-fix\"],\"path\":\"advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec\"},{\"advisory\":\"https://github.com/advisories/GHSA-4c5c-2vc3-x5w2\",\"aliases\":[\"CVE-2024-27928\"],\"commit\":\"https://github.com/github/advisory-database/commit/09a0c50f4c060b454b1beba39b06607b692ae442\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/09a0c50f4c060b454b1beba39b06607b692ae442/advisories/github-reviewed/2026/06/GHSA-4c5c-2vc3-x5w2/GHSA-4c5c-2vc3-x5w2.json\",\"id\":\"GHSA-4c5c-2vc3-x5w2\",\"packages\":[\"vantage6\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-4c5c-2vc3-x5w2/GHSA-4c5c-2vc3-x5w2.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Vantage6: 2FA can be circumvented with hacked email access\"},{\"advisory\":\"https://github.com/advisories/GHSA-5549-c5q7-fj65\",\"aliases\":[\"CVE-2024-24769\"],\"commit\":\"https://github.com/github/advisory-database/commit/3ad38b79a298df87ea7277ef69a97bdf8ac19070\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/3ad38b79a298df87ea7277ef69a97bdf8ac19070/advisories/github-reviewed/2026/06/GHSA-5549-c5q7-fj65/GHSA-5549-c5q7-fj65.json\",\"id\":\"GHSA-5549-c5q7-fj65\",\"packages\":[\"vantage6\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-5549-c5q7-fj65/GHSA-5549-c5q7-fj65.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"Vantage6: No limit on emails sent for password/MFA reset\"},{\"advisory\":\"https://github.com/advisories/GHSA-gg2p-37pv-v7fq\",\"aliases\":[\"CVE-2026-18948\"],\"commit\":\"https://github.com/github/advisory-database/commit/2f5c9c3dc515527cf27c5dea15ea0c286b09a6a1\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/2f5c9c3dc515527cf27c5dea15ea0c286b09a6a1/advisories/github-reviewed/2026/08/GHSA-gg2p-37pv-v7fq/GHSA-gg2p-37pv-v7fq.json\",\"id\":\"GHSA-gg2p-37pv-v7fq\",\"packages\":[\"feast\"],\"path\":\"advisories/github-reviewed/2026/08/GHSA-gg2p-37pv-v7fq/GHSA-gg2p-37pv-v7fq.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs\"},{\"advisory\":\"https://github.com/advisories/GHSA-263q-5cv3-xq9g\",\"aliases\":[\"CVE-2025-68939\"],\"commit\":\"https://github.com/github/advisory-database/commit/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3/advisories/github-reviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json\",\"id\":\"GHSA-263q-5cv3-xq9g\",\"packages\":[\"code.gitea.io/gitea\"],\"path\":\"advisories/github-reviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Gitea allows attackers to add attachments with forbidden file extensions\"},{\"advisory\":\"https://github.com/advisories/GHSA-2fqr-mr3j-6wp8\",\"aliases\":[\"CVE-2026-54279\"],\"commit\":\"https://github.com/github/advisory-database/commit/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3/advisories/github-reviewed/2026/06/GHSA-2fqr-mr3j-6wp8/GHSA-2fqr-mr3j-6wp8.json\",\"id\":\"GHSA-2fqr-mr3j-6wp8\",\"packages\":[\"aiohttp\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-2fqr-mr3j-6wp8/GHSA-2fqr-mr3j-6wp8.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence\"},{\"advisory\":\"https://github.com/advisories/GHSA-m3qr-fvp4-78xj\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/20d31bd4c8caa6b82129e0d004e578e5cebe8f91\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/20d31bd4c8caa6b82129e0d004e578e5cebe8f91/advisories/github-reviewed/2026/11/GHSA-m3qr-fvp4-78xj/GHSA-m3qr-fvp4-78xj.json\",\"id\":\"GHSA-m3qr-fvp4-78xj\",\"packages\":[\"github.com/basekick-labs/arc\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-m3qr-fvp4-78xj/GHSA-m3qr-fvp4-78xj.json\",\"severity\":\"LOW\",\"status\":\"published\",\"summary\":\"Arc has unauthenticated application log disclosure via `/api/v1/logs`\"},{\"advisory\":\"https://github.com/advisories/GHSA-h26j-4vp7-x9w2\",\"aliases\":[\"CVE-2026-62848\"],\"commit\":\"https://github.com/github/advisory-database/commit/5742631ca9236a1b99fb823b7dc5746894dc9c97\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/5742631ca9236a1b99fb823b7dc5746894dc9c97/advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json\",\"id\":\"GHSA-h26j-4vp7-x9w2\",\"packages\":[\"Metalama.Framework\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution\"},{\"advisory\":\"https://github.com/advisories/GHSA-9ppr-wfw9-xvr2\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/2c0fc1b40f792460bac314a3589ee722fddf9ab7\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/2c0fc1b40f792460bac314a3589ee722fddf9ab7/advisories/github-reviewed/2026/11/GHSA-9ppr-wfw9-xvr2/GHSA-9ppr-wfw9-xvr2.json\",\"id\":\"GHSA-9ppr-wfw9-xvr2\",\"packages\":[\"github.com/tinfoil-factory/netfoil\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-9ppr-wfw9-xvr2/GHSA-9ppr-wfw9-xvr2.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Netfoil doesn't decrement TTL\"},{\"advisory\":\"https://github.com/advisories/GHSA-g27p-qf6j-c96c\",\"aliases\":[\"CVE-2026-102870\"],\"commit\":\"https://github.com/github/advisory-database/commit/0713d11c551f4fb074272b59e61c545ca28b395e\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/0713d11c551f4fb074272b59e61c545ca28b395e/advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json\",\"id\":\"GHSA-g27p-qf6j-c96c\",\"packages\":[\"Microsoft.AspNetCore.Components.WebAssembly.Server\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-4mpw-cpwj-hxxj\",\"aliases\":[\"CVE-2026-70197\"],\"commit\":\"https://github.com/github/advisory-database/commit/1b2b2b1ca2543a77a29a869f05f5d5ab9a48832d\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/1b2b2b1ca2543a77a29a869f05f5d5ab9a48832d/advisories/github-reviewed/2026/10/GHSA-4mpw-cpwj-hxxj/GHSA-4mpw-cpwj-hxxj.json\",\"id\":\"GHSA-4mpw-cpwj-hxxj\",\"packages\":[\"Microsoft.NETCore.App.Runtime.win-arm64\",\"Microsoft.NETCore.App.Runtime.win-x64\",\"Microsoft.NETCore.App.Runtime.win-x86\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-4mpw-cpwj-hxxj/GHSA-4mpw-cpwj-hxxj.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-9v8h-qqgm-4m35\",\"aliases\":[\"CVE-2026-111497\"],\"commit\":\"https://github.com/github/advisory-database/commit/a8429404393e1324233442f9b6b686fa23906d49\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/a8429404393e1324233442f9b6b686fa23906d49/advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json\",\"id\":\"GHSA-9v8h-qqgm-4m35\",\"packages\":[\"brotli\",\"brotlicffi\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Brotli: Out-of-bounds write in the Brotli decoder (\\\"Node2Shell\\\") also affects the PyPI Brotli package\"},{\"advisory\":\"https://github.com/advisories/GHSA-g27p-qf6j-c96c\",\"aliases\":[\"CVE-2026-102870\"],\"commit\":\"https://github.com/github/advisory-database/commit/a8429404393e1324233442f9b6b686fa23906d49\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/a8429404393e1324233442f9b6b686fa23906d49/advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json\",\"id\":\"GHSA-g27p-qf6j-c96c\",\"packages\":[\"Microsoft.AspNetCore.Components.WebAssembly.Server\"],\"path\":\"advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-gqj5-2xp5-3qmp\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/6b4ca00b2205554fe416e66ca4f6bbaa419faff0\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/6b4ca00b2205554fe416e66ca4f6bbaa419faff0/advisories/github-reviewed/2026/06/GHSA-gqj5-2xp5-3qmp/GHSA-gqj5-2xp5-3qmp.json\",\"id\":\"GHSA-gqj5-2xp5-3qmp\",\"packages\":[\"org.keycloak:keycloak-services\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-gqj5-2xp5-3qmp/GHSA-gqj5-2xp5-3qmp.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: Authentication bypass via jwt algorithm confusion\"},{\"advisory\":\"https://github.com/advisories/GHSA-48v2-6jcm-fc99\",\"aliases\":[\"CVE-2026-62331\"],\"commit\":\"https://github.com/github/advisory-database/commit/2b369933cd4a9c17398ae7d4532f48e2ac48c173\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/2b369933cd4a9c17398ae7d4532f48e2ac48c173/advisories/github-reviewed/2026/11/GHSA-48v2-6jcm-fc99/GHSA-48v2-6jcm-fc99.json\",\"id\":\"GHSA-48v2-6jcm-fc99\",\"packages\":[\"github.com/mtzanidakis/praktor\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-48v2-6jcm-fc99/GHSA-48v2-6jcm-fc99.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)\"},{\"advisory\":\"https://github.com/advisories/GHSA-j97h-3f8r-mrjr\",\"aliases\":[\"CVE-2026-11800\"],\"commit\":\"https://github.com/github/advisory-database/commit/2b369933cd4a9c17398ae7d4532f48e2ac48c173\",\"ecosystems\":[\"Maven\"],\"file\":\"https://github.com/github/advisory-database/blob/2b369933cd4a9c17398ae7d4532f48e2ac48c173/advisories/github-reviewed/2026/11/GHSA-j97h-3f8r-mrjr/GHSA-j97h-3f8r-mrjr.json\",\"id\":\"GHSA-j97h-3f8r-mrjr\",\"packages\":[\"org.keycloak:keycloak-services\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-j97h-3f8r-mrjr/GHSA-j97h-3f8r-mrjr.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Keycloak has authentication bypass via jwt algorithm confusion\"},{\"advisory\":\"https://github.com/advisories/GHSA-p3jp-9v83-76w9\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/772fd8ac4b2e4d12a16d65630979ba79c9a7e82f\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/772fd8ac4b2e4d12a16d65630979ba79c9a7e82f/advisories/github-reviewed/2026/11/GHSA-p3jp-9v83-76w9/GHSA-p3jp-9v83-76w9.json\",\"id\":\"GHSA-p3jp-9v83-76w9\",\"packages\":[\"Microsoft.DotNet.ILCompiler\",\"Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64\",\"Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64\",\"Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64\",\"Microsoft.NETCore.App.Runtime.Mono.android-arm\",\"Microsoft.NETCore.App.Runtime.Mono.android-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.android-x64\",\"Microsoft.NETCore.App.Runtime.Mono.android-x86\",\"Microsoft.NETCore.App.Runtime.Mono.browser-wasm\",\"Microsoft.NETCore.App.Runtime.Mono.ios-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64\",\"Microsoft.NETCore.App.Runtime.Mono.linux-arm\",\"Microsoft.NETCore.App.Runtime.Mono.linux-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64\",\"Microsoft.NETCore.App.Runtime.Mono.linux-x64\",\"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64\",\"Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm\",\"Microsoft.NETCore.App.Runtime.Mono.osx-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.osx-x64\",\"Microsoft.NETCore.App.Runtime.Mono.tvos-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64\",\"Microsoft.NETCore.App.Runtime.Mono.wasi-wasm\",\"Microsoft.NETCore.App.Runtime.Mono.win-x64\",\"Microsoft.NETCore.App.Runtime.Mono.win-x86\",\"Microsoft.NETCore.App.Runtime.linux-arm\",\"Microsoft.NETCore.App.Runtime.linux-arm64\",\"Microsoft.NETCore.App.Runtime.linux-bionic-arm64\",\"Microsoft.NETCore.App.Runtime.linux-bionic-x64\",\"Microsoft.NETCore.App.Runtime.linux-musl-arm\",\"Microsoft.NETCore.App.Runtime.linux-musl-arm64\",\"Microsoft.NETCore.App.Runtime.linux-musl-x64\",\"Microsoft.NETCore.App.Runtime.linux-x64\",\"Microsoft.NETCore.App.Runtime.osx-arm64\",\"Microsoft.NETCore.App.Runtime.osx-x64\",\"Microsoft.NETCore.App.Runtime.win-arm64\",\"Microsoft.NETCore.App.Runtime.win-x64\",\"Microsoft.NETCore.App.Runtime.win-x86\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.win-x64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.win-x86\",\"Microsoft.NETCore.App.Runtime.NativeAOT.android-arm\",\"Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64\",\"Microsoft.NETCore.App.Runtime.NativeAOT.android-x64\",\"Microsoft.NETCore.App.Runtime.android-arm64\",\"Microsoft.NETCore.App.Runtime.android-x64\",\"Microsoft.NETCore.App.Runtime.android-arm\",\"Microsoft.NETCore.App.Runtime.browser-wasm\",\"Microsoft.NETCore.App.Runtime.ios-arm64\",\"Microsoft.NETCore.App.Runtime.iossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.iossimulator-x64\",\"Microsoft.NETCore.App.Runtime.maccatalyst-arm64\",\"Microsoft.NETCore.App.Runtime.maccatalyst-x64\",\"Microsoft.NETCore.App.Runtime.tvos-arm64\",\"Microsoft.NETCore.App.Runtime.tvossimulator-arm64\",\"Microsoft.NETCore.App.Runtime.tvossimulator-x64\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-p3jp-9v83-76w9/GHSA-p3jp-9v83-76w9.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-8vvx-qvq9-5948\",\"aliases\":[\"CVE-2025-71338\"],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/03/GHSA-8vvx-qvq9-5948/GHSA-8vvx-qvq9-5948.json\",\"id\":\"GHSA-8vvx-qvq9-5948\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2025/03/GHSA-8vvx-qvq9-5948/GHSA-8vvx-qvq9-5948.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Flowise allows arbitrary file write to RCE\"},{\"advisory\":\"https://github.com/advisories/GHSA-3gf5-cxq9-w223\",\"aliases\":[\"CVE-2025-71340\"],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/08/GHSA-3gf5-cxq9-w223/GHSA-3gf5-cxq9-w223.json\",\"id\":\"GHSA-3gf5-cxq9-w223\",\"packages\":[\"picklescan\"],\"path\":\"advisories/github-reviewed/2025/08/GHSA-3gf5-cxq9-w223/GHSA-3gf5-cxq9-w223.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode\"},{\"advisory\":\"https://github.com/advisories/GHSA-6933-jpx5-q87q\",\"aliases\":[\"CVE-2025-71336\"],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/09/GHSA-6933-jpx5-q87q/GHSA-6933-jpx5-q87q.json\",\"id\":\"GHSA-6933-jpx5-q87q\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2025/09/GHSA-6933-jpx5-q87q/GHSA-6933-jpx5-q87q.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Flowise has unsandboxed remote code execution via Custom MCP\"},{\"advisory\":\"https://github.com/advisories/GHSA-q67q-549q-p849\",\"aliases\":[\"CVE-2025-71334\"],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/09/GHSA-q67q-549q-p849/GHSA-q67q-549q-p849.json\",\"id\":\"GHSA-q67q-549q-p849\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2025/09/GHSA-q67q-549q-p849/GHSA-q67q-549q-p849.json\",\"severity\":\"CRITICAL\",\"status\":\"changed\",\"summary\":\"Flowise has arbitrary file access due to missing chat flow id validation\"},{\"advisory\":\"https://github.com/advisories/GHSA-273h-m46v-96q4\",\"aliases\":[\"CVE-2026-56367\"],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/02/GHSA-273h-m46v-96q4/GHSA-273h-m46v-96q4.json\",\"id\":\"GHSA-273h-m46v-96q4\",\"packages\":[\"Magick.NET-Q16-AnyCPU\",\"Magick.NET-Q16-HDRI-AnyCPU\",\"Magick.NET-Q16-HDRI-OpenMP-arm64\",\"Magick.NET-Q16-HDRI-OpenMP-x64\",\"Magick.NET-Q16-HDRI-arm64\",\"Magick.NET-Q16-HDRI-x64\",\"Magick.NET-Q16-HDRI-x86\",\"Magick.NET-Q16-OpenMP-arm64\",\"Magick.NET-Q16-OpenMP-x64\",\"Magick.NET-Q16-OpenMP-x86\",\"Magick.NET-Q16-arm64\",\"Magick.NET-Q16-x64\",\"Magick.NET-Q16-x86\",\"Magick.NET-Q8-AnyCPU\",\"Magick.NET-Q8-OpenMP-arm64\",\"Magick.NET-Q8-OpenMP-x64\",\"Magick.NET-Q8-arm64\",\"Magick.NET-Q8-x64\",\"Magick.NET-Q8-x86\"],\"path\":\"advisories/github-reviewed/2026/02/GHSA-273h-m46v-96q4/GHSA-273h-m46v-96q4.json\",\"severity\":\"LOW\",\"status\":\"changed\",\"summary\":\"ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds\"},{\"advisory\":\"https://github.com/advisories/GHSA-c3hj-m5hq-59xw\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-c3hj-m5hq-59xw/GHSA-c3hj-m5hq-59xw.json\",\"id\":\"GHSA-c3hj-m5hq-59xw\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-c3hj-m5hq-59xw/GHSA-c3hj-m5hq-59xw.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Duplicate Advisory : Flowise allows arbitrary file write to RCE\"},{\"advisory\":\"https://github.com/advisories/GHSA-mq7r-vm99-p7vx\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-mq7r-vm99-p7vx/GHSA-mq7r-vm99-p7vx.json\",\"id\":\"GHSA-mq7r-vm99-p7vx\",\"packages\":[\"picklescan\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-mq7r-vm99-p7vx/GHSA-mq7r-vm99-p7vx.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode\"},{\"advisory\":\"https://github.com/advisories/GHSA-q2xp-j85q-883h\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-q2xp-j85q-883h/GHSA-q2xp-j85q-883h.json\",\"id\":\"GHSA-q2xp-j85q-883h\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-q2xp-j85q-883h/GHSA-q2xp-j85q-883h.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP\"},{\"advisory\":\"https://github.com/advisories/GHSA-rg39-4fm5-hrp2\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"NuGet\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-rg39-4fm5-hrp2/GHSA-rg39-4fm5-hrp2.json\",\"id\":\"GHSA-rg39-4fm5-hrp2\",\"packages\":[\"Magick.NET-Q8-x86\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-rg39-4fm5-hrp2/GHSA-rg39-4fm5-hrp2.json\",\"severity\":\"MODERATE\",\"status\":\"published\",\"summary\":\"Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds\"},{\"advisory\":\"https://github.com/advisories/GHSA-w5r9-j49j-2m55\",\"aliases\":[],\"commit\":\"https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-w5r9-j49j-2m55/GHSA-w5r9-j49j-2m55.json\",\"id\":\"GHSA-w5r9-j49j-2m55\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-w5r9-j49j-2m55/GHSA-w5r9-j49j-2m55.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Duplicate Advisory : Flowise has arbitrary file access due to missing chat flow id validation\"},{\"advisory\":\"https://github.com/advisories/GHSA-q2hg-643c-gw8h\",\"aliases\":[\"CVE-2025-54550\"],\"commit\":\"https://github.com/github/advisory-database/commit/bfee4fa8fd91e14b833b776680f2381a9311a967\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/bfee4fa8fd91e14b833b776680f2381a9311a967/advisories/github-reviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json\",\"id\":\"GHSA-q2hg-643c-gw8h\",\"packages\":[\"apache-airflow\"],\"path\":\"advisories/github-reviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json\",\"severity\":\"HIGH\",\"status\":\"withdrawn\",\"summary\":\"Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag\"},{\"advisory\":\"https://github.com/advisories/GHSA-x9rp-7wh3-2rj5\",\"aliases\":[\"CVE-2026-44265\"],\"commit\":\"https://github.com/github/advisory-database/commit/3166063e03a19d7eaa16d650902b995c4946ccac\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/3166063e03a19d7eaa16d650902b995c4946ccac/advisories/github-reviewed/2026/11/GHSA-x9rp-7wh3-2rj5/GHSA-x9rp-7wh3-2rj5.json\",\"id\":\"GHSA-x9rp-7wh3-2rj5\",\"packages\":[\"@enspirit/elo\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-x9rp-7wh3-2rj5/GHSA-x9rp-7wh3-2rj5.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Elo backends have code injection via unvalidated emission of programmatic AST fields\"},{\"advisory\":\"https://github.com/advisories/GHSA-33r5-xmm8-v6x5\",\"aliases\":[\"CVE-2026-44267\"],\"commit\":\"https://github.com/github/advisory-database/commit/7afed176f45c534bccb2f43fa4272d08dafd4efb\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/7afed176f45c534bccb2f43fa4272d08dafd4efb/advisories/github-reviewed/2026/11/GHSA-33r5-xmm8-v6x5/GHSA-33r5-xmm8-v6x5.json\",\"id\":\"GHSA-33r5-xmm8-v6x5\",\"packages\":[\"@enspirit/elo\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-33r5-xmm8-v6x5/GHSA-33r5-xmm8-v6x5.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access\"},{\"advisory\":\"https://github.com/advisories/GHSA-7w38-ggh5-v542\",\"aliases\":[\"CVE-2026-44266\"],\"commit\":\"https://github.com/github/advisory-database/commit/7afed176f45c534bccb2f43fa4272d08dafd4efb\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/7afed176f45c534bccb2f43fa4272d08dafd4efb/advisories/github-reviewed/2026/11/GHSA-7w38-ggh5-v542/GHSA-7w38-ggh5-v542.json\",\"id\":\"GHSA-7w38-ggh5-v542\",\"packages\":[\"@enspirit/elo\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-7w38-ggh5-v542/GHSA-7w38-ggh5-v542.json\",\"severity\":\"CRITICAL\",\"status\":\"published\",\"summary\":\"Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels\"},{\"advisory\":\"https://github.com/advisories/GHSA-m9cv-24rx-8mv7\",\"aliases\":[\"CVE-2026-55409\"],\"commit\":\"https://github.com/github/advisory-database/commit/bfb1ff7326519dc6a6f4a1ac745d1b011e5b17e4\",\"ecosystems\":[\"Packagist\"],\"file\":\"https://github.com/github/advisory-database/blob/bfb1ff7326519dc6a6f4a1ac745d1b011e5b17e4/advisories/github-reviewed/2026/06/GHSA-m9cv-24rx-8mv7/GHSA-m9cv-24rx-8mv7.json\",\"id\":\"GHSA-m9cv-24rx-8mv7\",\"packages\":[\"filament/forms\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-m9cv-24rx-8mv7/GHSA-m9cv-24rx-8mv7.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"Filament: Disabled RichEditor field state can be used for XSS\"},{\"advisory\":\"https://github.com/advisories/GHSA-q6r4-3wmg-fwcq\",\"aliases\":[\"CVE-2026-55686\"],\"commit\":\"https://github.com/github/advisory-database/commit/c85a0fbb78e2cf8aa52f64a30136b1361c9751a1\",\"ecosystems\":[\"Go\"],\"file\":\"https://github.com/github/advisory-database/blob/c85a0fbb78e2cf8aa52f64a30136b1361c9751a1/advisories/github-reviewed/2026/06/GHSA-q6r4-3wmg-fwcq/GHSA-q6r4-3wmg-fwcq.json\",\"id\":\"GHSA-q6r4-3wmg-fwcq\",\"packages\":[\"github.com/containers/podman/v5\",\"github.com/containers/podman/v4\",\"github.com/containers/podman/v3\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-q6r4-3wmg-fwcq/GHSA-q6r4-3wmg-fwcq.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Podman: WORKDIR symlink traversal vulnerability\"},{\"advisory\":\"https://github.com/advisories/GHSA-9c4c-g95m-c8cp\",\"aliases\":[\"CVE-2025-71332\"],\"commit\":\"https://github.com/github/advisory-database/commit/2d4bd9ec59f215311b7e656b111083fc252ac893\",\"ecosystems\":[\"npm\"],\"file\":\"https://github.com/github/advisory-database/blob/2d4bd9ec59f215311b7e656b111083fc252ac893/advisories/github-reviewed/2025/04/GHSA-9c4c-g95m-c8cp/GHSA-9c4c-g95m-c8cp.json\",\"id\":\"GHSA-9c4c-g95m-c8cp\",\"packages\":[\"flowise\"],\"path\":\"advisories/github-reviewed/2025/04/GHSA-9c4c-g95m-c8cp/GHSA-9c4c-g95m-c8cp.json\",\"severity\":\"HIGH\",\"status\":\"changed\",\"summary\":\"FlowiseDB vulnerable to SQL Injection by authenticated users\"},{\"advisory\":\"https://github.com/advisories/GHSA-29hf-rm4x-xxph\",\"aliases\":[\"CVE-2026-55448\"],\"commit\":\"https://github.com/github/advisory-database/commit/b91a7d18bf660e4df3d16ce86ea8a4c5683e1a74\",\"ecosystems\":[\"crates.io\"],\"file\":\"https://github.com/github/advisory-database/blob/b91a7d18bf660e4df3d16ce86ea8a4c5683e1a74/advisories/github-reviewed/2026/06/GHSA-29hf-rm4x-xxph/GHSA-29hf-rm4x-xxph.json\",\"id\":\"GHSA-29hf-rm4x-xxph\",\"packages\":[\"mise\"],\"path\":\"advisories/github-reviewed/2026/06/GHSA-29hf-rm4x-xxph/GHSA-29hf-rm4x-xxph.json\",\"severity\":\"MODERATE\",\"status\":\"changed\",\"summary\":\"Mise's local credential_command executes untrusted config\"},{\"advisory\":\"https://github.com/advisories/GHSA-gh9r-c94j-cmp5\",\"aliases\":[\"CVE-2026-115878\"],\"commit\":\"https://github.com/github/advisory-database/commit/17f6aad969d6fbf66d428725d56c65072693f130\",\"ecosystems\":[\"PyPI\"],\"file\":\"https://github.com/github/advisory-database/blob/17f6aad969d6fbf66d428725d56c65072693f130/advisories/github-reviewed/2026/11/GHSA-gh9r-c94j-cmp5/GHSA-gh9r-c94j-cmp5.json\",\"id\":\"GHSA-gh9r-c94j-cmp5\",\"packages\":[\"stanza\"],\"path\":\"advisories/github-reviewed/2026/11/GHSA-gh9r-c94j-cmp5/GHSA-gh9r-c94j-cmp5.json\",\"severity\":\"HIGH\",\"status\":\"published\",\"summary\":\"Stanza: RCE via pickle deserialization in the lemmatizer\"}],\"sourceId\":\"advisories-reviewed\",\"text\":\"On November 3, 2026, GitHub's security advisory list published 22 new advisories, changed 29, and withdrew 1. A security advisory is a public warning about a hole in a piece of software.\",\"v\":1}", "structured": null, "uri": "https://flarereef.flareforward.com/files/watch/59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc.json", "txHash": "0x465af45fc372ae49f58b88dd2f00e90b86e9d71b08ff5fbb446099f6000eb27c", "receiptUrl": "https://flare-explorer.flare.network/tx/0x465af45fc372ae49f58b88dd2f00e90b86e9d71b08ff5fbb446099f6000eb27c", "blockNumber": 73691892, "voice": null, "voiceReceipt": null, "amendmentReason": null, "amendmentFingerprint": null, "retractedReason": null, "authorTier": 1, "factors": ["Verified"], "withheld": null, "checkResults": []}], "threads": [{"projectId": 20, "rootNoteId": 208, "standing": "stands", "receiptCount": 0, "inputs": {"notes": [{"factors": ["Verified"], "inReplyTo": 0, "kind": 3, "noteId": 208, "retracted": false, "voice": null, "weight": 1.5, "withheld": false}], "rootNoteId": 208, "version": "0.3"}}, {"projectId": 20, "rootNoteId": 209, "standing": "stands", "receiptCount": 0, "inputs": {"notes": [{"factors": ["Verified"], "inReplyTo": 0, "kind": 3, "noteId": 209, "retracted": false, "voice": null, "weight": 1.5, "withheld": false}], "rootNoteId": 209, "version": "0.3"}}, {"projectId": 20, "rootNoteId": 212, "standing": "stands", "receiptCount": 0, "inputs": {"notes": [{"factors": ["Verified"], "inReplyTo": 0, "kind": 3, "noteId": 212, "retracted": false, "voice": null, "weight": 1.5, "withheld": false}], "rootNoteId": 212, "version": "0.3"}}, {"projectId": 20, "rootNoteId": 262, "standing": "stands", "receiptCount": 0, "inputs": {"notes": [{"factors": ["Verified"], "inReplyTo": 0, "kind": 3, "noteId": 262, "retracted": false, "voice": null, "weight": 1.5, "withheld": false}], "rootNoteId": 262, "version": "0.3"}}, {"projectId": 20, "rootNoteId": 357, "standing": "stands", "receiptCount": 0, "inputs": {"notes": [{"factors": ["Verified"], "inReplyTo": 0, "kind": 3, "noteId": 357, "retracted": false, "voice": null, "weight": 1.5, "withheld": false}], "rootNoteId": 357, "version": "0.3"}}, {"projectId": 20, "rootNoteId": 418, "standing": "stands", "receiptCount": 0, "inputs": {"notes": [{"factors": ["Verified"], "inReplyTo": 0, "kind": 3, "noteId": 418, "retracted": false, "voice": null, "weight": 1.5, "withheld": false}], "rootNoteId": 418, "version": "0.3"}}], "voiceLabels": [], "card": {"projectId": 20, "name": "Security advisories (GitHub reviewed)", "kind": "watch", "markText": "GH", "findingsCount": 5, "statusLine": "5 days on record \u00b7 Latest Nov 3, 2026", "checked": "2026-11-03", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0."}, "record": {"sourceId": "advisories-reviewed", "keeper": "GitHub", "what": "GitHub's security advisory list", "repoUrl": "https://github.com/github/advisory-database", "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "markText": "GH", "chunk": "day", "noun": "", "entries": [{"counts": {"changed": 29, "published": 22, "removed": 0, "withdrawn": 1}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-03", "kind": "watch-day", "recordedAt": "2026-11-04T02:17:13Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-wp3j-xq48-xpjw", "aliases": ["CVE-2025-9566"], "commit": "https://github.com/github/advisory-database/commit/887dcb68f13a7d9be8bf3d604c2e32fc3d6960e8", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/887dcb68f13a7d9be8bf3d604c2e32fc3d6960e8/advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json", "id": "GHSA-wp3j-xq48-xpjw", "packages": ["github.com/containers/podman/v5", "github.com/containers/podman/v4"], "path": "advisories/github-reviewed/2025/09/GHSA-wp3j-xq48-xpjw/GHSA-wp3j-xq48-xpjw.json", "severity": "HIGH", "status": "changed", "summary": "podman kube play symlink traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-v653-r55g-hcmg", "aliases": ["CVE-2025-13327"], "commit": "https://github.com/github/advisory-database/commit/109512409477d1b7dfa372b0346a28a59d47e04d", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/109512409477d1b7dfa372b0346a28a59d47e04d/advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "id": "GHSA-v653-r55g-hcmg", "packages": ["uv"], "path": "advisories/github-reviewed/2026/02/GHSA-v653-r55g-hcmg/GHSA-v653-r55g-hcmg.json", "severity": "MODERATE", "status": "changed", "summary": "uv has ZIP payload obfuscation through parsing differentials"}, {"advisory": "https://github.com/advisories/GHSA-f23m-r3pf-42rh", "aliases": ["CVE-2026-2950"], "commit": "https://github.com/github/advisory-database/commit/0b1941f7d05b03f4ed6469b0236dd3c59357f497", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/0b1941f7d05b03f4ed6469b0236dd3c59357f497/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json", "id": "GHSA-f23m-r3pf-42rh", "packages": ["lodash", "lodash-es", "lodash-amd", "lodash.unset", "lodash.omit"], "path": "advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json", "severity": "MODERATE", "status": "changed", "summary": "lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt"}, {"advisory": "https://github.com/advisories/GHSA-2cvf-wqm6-wr9g", "aliases": ["CVE-2026-94603"], "commit": "https://github.com/github/advisory-database/commit/b9d5dfa2061837f892e2cdbecfe33751bcd902fa", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/b9d5dfa2061837f892e2cdbecfe33751bcd902fa/advisories/github-reviewed/2026/10/GHSA-2cvf-wqm6-wr9g/GHSA-2cvf-wqm6-wr9g.json", "id": "GHSA-2cvf-wqm6-wr9g", "packages": ["github.com/containers/podman/v4", "go.podman.io/podman/v6", "github.com/containers/podman/v5"], "path": "advisories/github-reviewed/2026/10/GHSA-2cvf-wqm6-wr9g/GHSA-2cvf-wqm6-wr9g.json", "severity": "CRITICAL", "status": "changed", "summary": "Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation"}, {"advisory": "https://github.com/advisories/GHSA-23f4-hfmq-94mj", "aliases": ["CVE-2026-24807"], "commit": "https://github.com/github/advisory-database/commit/1cd5f193871f6f187dcd0bb684096313535d13dc", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/1cd5f193871f6f187dcd0bb684096313535d13dc/advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json", "id": "GHSA-23f4-hfmq-94mj", "packages": ["com.github.liuyueyi.media:batik-codec-fix"], "path": "advisories/github-reviewed/2026/01/GHSA-23f4-hfmq-94mj/GHSA-23f4-hfmq-94mj.json", "severity": "MODERATE", "status": "changed", "summary": "Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec"}, {"advisory": "https://github.com/advisories/GHSA-4c5c-2vc3-x5w2", "aliases": ["CVE-2024-27928"], "commit": "https://github.com/github/advisory-database/commit/09a0c50f4c060b454b1beba39b06607b692ae442", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/09a0c50f4c060b454b1beba39b06607b692ae442/advisories/github-reviewed/2026/06/GHSA-4c5c-2vc3-x5w2/GHSA-4c5c-2vc3-x5w2.json", "id": "GHSA-4c5c-2vc3-x5w2", "packages": ["vantage6"], "path": "advisories/github-reviewed/2026/06/GHSA-4c5c-2vc3-x5w2/GHSA-4c5c-2vc3-x5w2.json", "severity": "MODERATE", "status": "changed", "summary": "Vantage6: 2FA can be circumvented with hacked email access"}, {"advisory": "https://github.com/advisories/GHSA-5549-c5q7-fj65", "aliases": ["CVE-2024-24769"], "commit": "https://github.com/github/advisory-database/commit/3ad38b79a298df87ea7277ef69a97bdf8ac19070", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/3ad38b79a298df87ea7277ef69a97bdf8ac19070/advisories/github-reviewed/2026/06/GHSA-5549-c5q7-fj65/GHSA-5549-c5q7-fj65.json", "id": "GHSA-5549-c5q7-fj65", "packages": ["vantage6"], "path": "advisories/github-reviewed/2026/06/GHSA-5549-c5q7-fj65/GHSA-5549-c5q7-fj65.json", "severity": "LOW", "status": "changed", "summary": "Vantage6: No limit on emails sent for password/MFA reset"}, {"advisory": "https://github.com/advisories/GHSA-gg2p-37pv-v7fq", "aliases": ["CVE-2026-18948"], "commit": "https://github.com/github/advisory-database/commit/2f5c9c3dc515527cf27c5dea15ea0c286b09a6a1", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/2f5c9c3dc515527cf27c5dea15ea0c286b09a6a1/advisories/github-reviewed/2026/08/GHSA-gg2p-37pv-v7fq/GHSA-gg2p-37pv-v7fq.json", "id": "GHSA-gg2p-37pv-v7fq", "packages": ["feast"], "path": "advisories/github-reviewed/2026/08/GHSA-gg2p-37pv-v7fq/GHSA-gg2p-37pv-v7fq.json", "severity": "CRITICAL", "status": "changed", "summary": "Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs"}, {"advisory": "https://github.com/advisories/GHSA-263q-5cv3-xq9g", "aliases": ["CVE-2025-68939"], "commit": "https://github.com/github/advisory-database/commit/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3/advisories/github-reviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json", "id": "GHSA-263q-5cv3-xq9g", "packages": ["code.gitea.io/gitea"], "path": "advisories/github-reviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json", "severity": "HIGH", "status": "changed", "summary": "Gitea allows attackers to add attachments with forbidden file extensions"}, {"advisory": "https://github.com/advisories/GHSA-2fqr-mr3j-6wp8", "aliases": ["CVE-2026-54279"], "commit": "https://github.com/github/advisory-database/commit/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/1fb1ef7a46bdb8dd9f8eb720a840dbecb943e2f3/advisories/github-reviewed/2026/06/GHSA-2fqr-mr3j-6wp8/GHSA-2fqr-mr3j-6wp8.json", "id": "GHSA-2fqr-mr3j-6wp8", "packages": ["aiohttp"], "path": "advisories/github-reviewed/2026/06/GHSA-2fqr-mr3j-6wp8/GHSA-2fqr-mr3j-6wp8.json", "severity": "LOW", "status": "changed", "summary": "aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence"}, {"advisory": "https://github.com/advisories/GHSA-m3qr-fvp4-78xj", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/20d31bd4c8caa6b82129e0d004e578e5cebe8f91", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/20d31bd4c8caa6b82129e0d004e578e5cebe8f91/advisories/github-reviewed/2026/11/GHSA-m3qr-fvp4-78xj/GHSA-m3qr-fvp4-78xj.json", "id": "GHSA-m3qr-fvp4-78xj", "packages": ["github.com/basekick-labs/arc"], "path": "advisories/github-reviewed/2026/11/GHSA-m3qr-fvp4-78xj/GHSA-m3qr-fvp4-78xj.json", "severity": "LOW", "status": "published", "summary": "Arc has unauthenticated application log disclosure via `/api/v1/logs`"}, {"advisory": "https://github.com/advisories/GHSA-h26j-4vp7-x9w2", "aliases": ["CVE-2026-62848"], "commit": "https://github.com/github/advisory-database/commit/5742631ca9236a1b99fb823b7dc5746894dc9c97", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/5742631ca9236a1b99fb823b7dc5746894dc9c97/advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json", "id": "GHSA-h26j-4vp7-x9w2", "packages": ["Metalama.Framework"], "path": "advisories/github-reviewed/2026/11/GHSA-h26j-4vp7-x9w2/GHSA-h26j-4vp7-x9w2.json", "severity": "HIGH", "status": "published", "summary": "Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution"}, {"advisory": "https://github.com/advisories/GHSA-9ppr-wfw9-xvr2", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/2c0fc1b40f792460bac314a3589ee722fddf9ab7", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2c0fc1b40f792460bac314a3589ee722fddf9ab7/advisories/github-reviewed/2026/11/GHSA-9ppr-wfw9-xvr2/GHSA-9ppr-wfw9-xvr2.json", "id": "GHSA-9ppr-wfw9-xvr2", "packages": ["github.com/tinfoil-factory/netfoil"], "path": "advisories/github-reviewed/2026/11/GHSA-9ppr-wfw9-xvr2/GHSA-9ppr-wfw9-xvr2.json", "severity": "MODERATE", "status": "published", "summary": "Netfoil doesn't decrement TTL"}, {"advisory": "https://github.com/advisories/GHSA-g27p-qf6j-c96c", "aliases": ["CVE-2026-102870"], "commit": "https://github.com/github/advisory-database/commit/0713d11c551f4fb074272b59e61c545ca28b395e", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/0713d11c551f4fb074272b59e61c545ca28b395e/advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "id": "GHSA-g27p-qf6j-c96c", "packages": ["Microsoft.AspNetCore.Components.WebAssembly.Server"], "path": "advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-4mpw-cpwj-hxxj", "aliases": ["CVE-2026-70197"], "commit": "https://github.com/github/advisory-database/commit/1b2b2b1ca2543a77a29a869f05f5d5ab9a48832d", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/1b2b2b1ca2543a77a29a869f05f5d5ab9a48832d/advisories/github-reviewed/2026/10/GHSA-4mpw-cpwj-hxxj/GHSA-4mpw-cpwj-hxxj.json", "id": "GHSA-4mpw-cpwj-hxxj", "packages": ["Microsoft.NETCore.App.Runtime.win-arm64", "Microsoft.NETCore.App.Runtime.win-x64", "Microsoft.NETCore.App.Runtime.win-x86"], "path": "advisories/github-reviewed/2026/10/GHSA-4mpw-cpwj-hxxj/GHSA-4mpw-cpwj-hxxj.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "aliases": ["CVE-2026-111497"], "commit": "https://github.com/github/advisory-database/commit/a8429404393e1324233442f9b6b686fa23906d49", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/a8429404393e1324233442f9b6b686fa23906d49/advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json", "id": "GHSA-9v8h-qqgm-4m35", "packages": ["brotli", "brotlicffi"], "path": "advisories/github-reviewed/2026/10/GHSA-9v8h-qqgm-4m35/GHSA-9v8h-qqgm-4m35.json", "severity": "CRITICAL", "status": "changed", "summary": "Brotli: Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package"}, {"advisory": "https://github.com/advisories/GHSA-g27p-qf6j-c96c", "aliases": ["CVE-2026-102870"], "commit": "https://github.com/github/advisory-database/commit/a8429404393e1324233442f9b6b686fa23906d49", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/a8429404393e1324233442f9b6b686fa23906d49/advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "id": "GHSA-g27p-qf6j-c96c", "packages": ["Microsoft.AspNetCore.Components.WebAssembly.Server"], "path": "advisories/github-reviewed/2026/10/GHSA-g27p-qf6j-c96c/GHSA-g27p-qf6j-c96c.json", "severity": "HIGH", "status": "changed", "summary": "Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-gqj5-2xp5-3qmp", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/6b4ca00b2205554fe416e66ca4f6bbaa419faff0", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/6b4ca00b2205554fe416e66ca4f6bbaa419faff0/advisories/github-reviewed/2026/06/GHSA-gqj5-2xp5-3qmp/GHSA-gqj5-2xp5-3qmp.json", "id": "GHSA-gqj5-2xp5-3qmp", "packages": ["org.keycloak:keycloak-services"], "path": "advisories/github-reviewed/2026/06/GHSA-gqj5-2xp5-3qmp/GHSA-gqj5-2xp5-3qmp.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory: Authentication bypass via jwt algorithm confusion"}, {"advisory": "https://github.com/advisories/GHSA-48v2-6jcm-fc99", "aliases": ["CVE-2026-62331"], "commit": "https://github.com/github/advisory-database/commit/2b369933cd4a9c17398ae7d4532f48e2ac48c173", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/2b369933cd4a9c17398ae7d4532f48e2ac48c173/advisories/github-reviewed/2026/11/GHSA-48v2-6jcm-fc99/GHSA-48v2-6jcm-fc99.json", "id": "GHSA-48v2-6jcm-fc99", "packages": ["github.com/mtzanidakis/praktor"], "path": "advisories/github-reviewed/2026/11/GHSA-48v2-6jcm-fc99/GHSA-48v2-6jcm-fc99.json", "severity": "HIGH", "status": "published", "summary": "praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)"}, {"advisory": "https://github.com/advisories/GHSA-j97h-3f8r-mrjr", "aliases": ["CVE-2026-11800"], "commit": "https://github.com/github/advisory-database/commit/2b369933cd4a9c17398ae7d4532f48e2ac48c173", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/2b369933cd4a9c17398ae7d4532f48e2ac48c173/advisories/github-reviewed/2026/11/GHSA-j97h-3f8r-mrjr/GHSA-j97h-3f8r-mrjr.json", "id": "GHSA-j97h-3f8r-mrjr", "packages": ["org.keycloak:keycloak-services"], "path": "advisories/github-reviewed/2026/11/GHSA-j97h-3f8r-mrjr/GHSA-j97h-3f8r-mrjr.json", "severity": "HIGH", "status": "published", "summary": "Keycloak has authentication bypass via jwt algorithm confusion"}, {"advisory": "https://github.com/advisories/GHSA-p3jp-9v83-76w9", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/772fd8ac4b2e4d12a16d65630979ba79c9a7e82f", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/772fd8ac4b2e4d12a16d65630979ba79c9a7e82f/advisories/github-reviewed/2026/11/GHSA-p3jp-9v83-76w9/GHSA-p3jp-9v83-76w9.json", "id": "GHSA-p3jp-9v83-76w9", "packages": ["Microsoft.DotNet.ILCompiler", "Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.maccatalyst-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.osx-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.osx-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.tvos-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.tvossimulator-x64", "Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64", "Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64", "Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64", "Microsoft.NETCore.App.Runtime.Mono.android-arm", "Microsoft.NETCore.App.Runtime.Mono.android-arm64", "Microsoft.NETCore.App.Runtime.Mono.android-x64", "Microsoft.NETCore.App.Runtime.Mono.android-x86", "Microsoft.NETCore.App.Runtime.Mono.browser-wasm", "Microsoft.NETCore.App.Runtime.Mono.ios-arm64", "Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64", "Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64", "Microsoft.NETCore.App.Runtime.Mono.linux-arm", "Microsoft.NETCore.App.Runtime.Mono.linux-arm64", "Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64", "Microsoft.NETCore.App.Runtime.Mono.linux-x64", "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64", "Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64", "Microsoft.NETCore.App.Runtime.Mono.multithread.browser-wasm", "Microsoft.NETCore.App.Runtime.Mono.osx-arm64", "Microsoft.NETCore.App.Runtime.Mono.osx-x64", "Microsoft.NETCore.App.Runtime.Mono.tvos-arm64", "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64", "Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64", "Microsoft.NETCore.App.Runtime.Mono.wasi-wasm", "Microsoft.NETCore.App.Runtime.Mono.win-x64", "Microsoft.NETCore.App.Runtime.Mono.win-x86", "Microsoft.NETCore.App.Runtime.linux-arm", "Microsoft.NETCore.App.Runtime.linux-arm64", "Microsoft.NETCore.App.Runtime.linux-bionic-arm64", "Microsoft.NETCore.App.Runtime.linux-bionic-x64", "Microsoft.NETCore.App.Runtime.linux-musl-arm", "Microsoft.NETCore.App.Runtime.linux-musl-arm64", "Microsoft.NETCore.App.Runtime.linux-musl-x64", "Microsoft.NETCore.App.Runtime.linux-x64", "Microsoft.NETCore.App.Runtime.osx-arm64", "Microsoft.NETCore.App.Runtime.osx-x64", "Microsoft.NETCore.App.Runtime.win-arm64", "Microsoft.NETCore.App.Runtime.win-x64", "Microsoft.NETCore.App.Runtime.win-x86", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-musl-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.linux-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.win-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.win-x64", "Microsoft.NETCore.App.Runtime.NativeAOT.win-x86", "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm", "Microsoft.NETCore.App.Runtime.NativeAOT.android-arm64", "Microsoft.NETCore.App.Runtime.NativeAOT.android-x64", "Microsoft.NETCore.App.Runtime.android-arm64", "Microsoft.NETCore.App.Runtime.android-x64", "Microsoft.NETCore.App.Runtime.android-arm", "Microsoft.NETCore.App.Runtime.browser-wasm", "Microsoft.NETCore.App.Runtime.ios-arm64", "Microsoft.NETCore.App.Runtime.iossimulator-arm64", "Microsoft.NETCore.App.Runtime.iossimulator-x64", "Microsoft.NETCore.App.Runtime.maccatalyst-arm64", "Microsoft.NETCore.App.Runtime.maccatalyst-x64", "Microsoft.NETCore.App.Runtime.tvos-arm64", "Microsoft.NETCore.App.Runtime.tvossimulator-arm64", "Microsoft.NETCore.App.Runtime.tvossimulator-x64"], "path": "advisories/github-reviewed/2026/11/GHSA-p3jp-9v83-76w9/GHSA-p3jp-9v83-76w9.json", "severity": "HIGH", "status": "published", "summary": "Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-8vvx-qvq9-5948", "aliases": ["CVE-2025-71338"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/03/GHSA-8vvx-qvq9-5948/GHSA-8vvx-qvq9-5948.json", "id": "GHSA-8vvx-qvq9-5948", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/03/GHSA-8vvx-qvq9-5948/GHSA-8vvx-qvq9-5948.json", "severity": "CRITICAL", "status": "changed", "summary": "Flowise allows arbitrary file write to RCE"}, {"advisory": "https://github.com/advisories/GHSA-3gf5-cxq9-w223", "aliases": ["CVE-2025-71340"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/08/GHSA-3gf5-cxq9-w223/GHSA-3gf5-cxq9-w223.json", "id": "GHSA-3gf5-cxq9-w223", "packages": ["picklescan"], "path": "advisories/github-reviewed/2025/08/GHSA-3gf5-cxq9-w223/GHSA-3gf5-cxq9-w223.json", "severity": "HIGH", "status": "changed", "summary": "Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode"}, {"advisory": "https://github.com/advisories/GHSA-6933-jpx5-q87q", "aliases": ["CVE-2025-71336"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/09/GHSA-6933-jpx5-q87q/GHSA-6933-jpx5-q87q.json", "id": "GHSA-6933-jpx5-q87q", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/09/GHSA-6933-jpx5-q87q/GHSA-6933-jpx5-q87q.json", "severity": "CRITICAL", "status": "changed", "summary": "Flowise has unsandboxed remote code execution via Custom MCP"}, {"advisory": "https://github.com/advisories/GHSA-q67q-549q-p849", "aliases": ["CVE-2025-71334"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2025/09/GHSA-q67q-549q-p849/GHSA-q67q-549q-p849.json", "id": "GHSA-q67q-549q-p849", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/09/GHSA-q67q-549q-p849/GHSA-q67q-549q-p849.json", "severity": "CRITICAL", "status": "changed", "summary": "Flowise has arbitrary file access due to missing chat flow id validation"}, {"advisory": "https://github.com/advisories/GHSA-273h-m46v-96q4", "aliases": ["CVE-2026-56367"], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/02/GHSA-273h-m46v-96q4/GHSA-273h-m46v-96q4.json", "id": "GHSA-273h-m46v-96q4", "packages": ["Magick.NET-Q16-AnyCPU", "Magick.NET-Q16-HDRI-AnyCPU", "Magick.NET-Q16-HDRI-OpenMP-arm64", "Magick.NET-Q16-HDRI-OpenMP-x64", "Magick.NET-Q16-HDRI-arm64", "Magick.NET-Q16-HDRI-x64", "Magick.NET-Q16-HDRI-x86", "Magick.NET-Q16-OpenMP-arm64", "Magick.NET-Q16-OpenMP-x64", "Magick.NET-Q16-OpenMP-x86", "Magick.NET-Q16-arm64", "Magick.NET-Q16-x64", "Magick.NET-Q16-x86", "Magick.NET-Q8-AnyCPU", "Magick.NET-Q8-OpenMP-arm64", "Magick.NET-Q8-OpenMP-x64", "Magick.NET-Q8-arm64", "Magick.NET-Q8-x64", "Magick.NET-Q8-x86"], "path": "advisories/github-reviewed/2026/02/GHSA-273h-m46v-96q4/GHSA-273h-m46v-96q4.json", "severity": "LOW", "status": "changed", "summary": "ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds"}, {"advisory": "https://github.com/advisories/GHSA-c3hj-m5hq-59xw", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-c3hj-m5hq-59xw/GHSA-c3hj-m5hq-59xw.json", "id": "GHSA-c3hj-m5hq-59xw", "packages": ["flowise"], "path": "advisories/github-reviewed/2026/06/GHSA-c3hj-m5hq-59xw/GHSA-c3hj-m5hq-59xw.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory : Flowise allows arbitrary file write to RCE"}, {"advisory": "https://github.com/advisories/GHSA-mq7r-vm99-p7vx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-mq7r-vm99-p7vx/GHSA-mq7r-vm99-p7vx.json", "id": "GHSA-mq7r-vm99-p7vx", "packages": ["picklescan"], "path": "advisories/github-reviewed/2026/06/GHSA-mq7r-vm99-p7vx/GHSA-mq7r-vm99-p7vx.json", "severity": "HIGH", "status": "published", "summary": "Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode"}, {"advisory": "https://github.com/advisories/GHSA-q2xp-j85q-883h", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-q2xp-j85q-883h/GHSA-q2xp-j85q-883h.json", "id": "GHSA-q2xp-j85q-883h", "packages": ["flowise"], "path": "advisories/github-reviewed/2026/06/GHSA-q2xp-j85q-883h/GHSA-q2xp-j85q-883h.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP"}, {"advisory": "https://github.com/advisories/GHSA-rg39-4fm5-hrp2", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["NuGet"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-rg39-4fm5-hrp2/GHSA-rg39-4fm5-hrp2.json", "id": "GHSA-rg39-4fm5-hrp2", "packages": ["Magick.NET-Q8-x86"], "path": "advisories/github-reviewed/2026/06/GHSA-rg39-4fm5-hrp2/GHSA-rg39-4fm5-hrp2.json", "severity": "MODERATE", "status": "published", "summary": "Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds"}, {"advisory": "https://github.com/advisories/GHSA-w5r9-j49j-2m55", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/b55477d13556e53acd3794d686556266ec52a168", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/b55477d13556e53acd3794d686556266ec52a168/advisories/github-reviewed/2026/06/GHSA-w5r9-j49j-2m55/GHSA-w5r9-j49j-2m55.json", "id": "GHSA-w5r9-j49j-2m55", "packages": ["flowise"], "path": "advisories/github-reviewed/2026/06/GHSA-w5r9-j49j-2m55/GHSA-w5r9-j49j-2m55.json", "severity": "CRITICAL", "status": "published", "summary": "Duplicate Advisory : Flowise has arbitrary file access due to missing chat flow id validation"}, {"advisory": "https://github.com/advisories/GHSA-q2hg-643c-gw8h", "aliases": ["CVE-2025-54550"], "commit": "https://github.com/github/advisory-database/commit/bfee4fa8fd91e14b833b776680f2381a9311a967", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/bfee4fa8fd91e14b833b776680f2381a9311a967/advisories/github-reviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json", "id": "GHSA-q2hg-643c-gw8h", "packages": ["apache-airflow"], "path": "advisories/github-reviewed/2026/04/GHSA-q2hg-643c-gw8h/GHSA-q2hg-643c-gw8h.json", "severity": "HIGH", "status": "withdrawn", "summary": "Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag"}, {"advisory": "https://github.com/advisories/GHSA-x9rp-7wh3-2rj5", "aliases": ["CVE-2026-44265"], "commit": "https://github.com/github/advisory-database/commit/3166063e03a19d7eaa16d650902b995c4946ccac", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/3166063e03a19d7eaa16d650902b995c4946ccac/advisories/github-reviewed/2026/11/GHSA-x9rp-7wh3-2rj5/GHSA-x9rp-7wh3-2rj5.json", "id": "GHSA-x9rp-7wh3-2rj5", "packages": ["@enspirit/elo"], "path": "advisories/github-reviewed/2026/11/GHSA-x9rp-7wh3-2rj5/GHSA-x9rp-7wh3-2rj5.json", "severity": "HIGH", "status": "published", "summary": "Elo backends have code injection via unvalidated emission of programmatic AST fields"}, {"advisory": "https://github.com/advisories/GHSA-33r5-xmm8-v6x5", "aliases": ["CVE-2026-44267"], "commit": "https://github.com/github/advisory-database/commit/7afed176f45c534bccb2f43fa4272d08dafd4efb", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7afed176f45c534bccb2f43fa4272d08dafd4efb/advisories/github-reviewed/2026/11/GHSA-33r5-xmm8-v6x5/GHSA-33r5-xmm8-v6x5.json", "id": "GHSA-33r5-xmm8-v6x5", "packages": ["@enspirit/elo"], "path": "advisories/github-reviewed/2026/11/GHSA-33r5-xmm8-v6x5/GHSA-33r5-xmm8-v6x5.json", "severity": "CRITICAL", "status": "published", "summary": "Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access"}, {"advisory": "https://github.com/advisories/GHSA-7w38-ggh5-v542", "aliases": ["CVE-2026-44266"], "commit": "https://github.com/github/advisory-database/commit/7afed176f45c534bccb2f43fa4272d08dafd4efb", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/7afed176f45c534bccb2f43fa4272d08dafd4efb/advisories/github-reviewed/2026/11/GHSA-7w38-ggh5-v542/GHSA-7w38-ggh5-v542.json", "id": "GHSA-7w38-ggh5-v542", "packages": ["@enspirit/elo"], "path": "advisories/github-reviewed/2026/11/GHSA-7w38-ggh5-v542/GHSA-7w38-ggh5-v542.json", "severity": "CRITICAL", "status": "published", "summary": "Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels"}, {"advisory": "https://github.com/advisories/GHSA-m9cv-24rx-8mv7", "aliases": ["CVE-2026-55409"], "commit": "https://github.com/github/advisory-database/commit/bfb1ff7326519dc6a6f4a1ac745d1b011e5b17e4", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/bfb1ff7326519dc6a6f4a1ac745d1b011e5b17e4/advisories/github-reviewed/2026/06/GHSA-m9cv-24rx-8mv7/GHSA-m9cv-24rx-8mv7.json", "id": "GHSA-m9cv-24rx-8mv7", "packages": ["filament/forms"], "path": "advisories/github-reviewed/2026/06/GHSA-m9cv-24rx-8mv7/GHSA-m9cv-24rx-8mv7.json", "severity": "HIGH", "status": "changed", "summary": "Filament: Disabled RichEditor field state can be used for XSS"}, {"advisory": "https://github.com/advisories/GHSA-q6r4-3wmg-fwcq", "aliases": ["CVE-2026-55686"], "commit": "https://github.com/github/advisory-database/commit/c85a0fbb78e2cf8aa52f64a30136b1361c9751a1", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/c85a0fbb78e2cf8aa52f64a30136b1361c9751a1/advisories/github-reviewed/2026/06/GHSA-q6r4-3wmg-fwcq/GHSA-q6r4-3wmg-fwcq.json", "id": "GHSA-q6r4-3wmg-fwcq", "packages": ["github.com/containers/podman/v5", "github.com/containers/podman/v4", "github.com/containers/podman/v3"], "path": "advisories/github-reviewed/2026/06/GHSA-q6r4-3wmg-fwcq/GHSA-q6r4-3wmg-fwcq.json", "severity": "MODERATE", "status": "changed", "summary": "Podman: WORKDIR symlink traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-9c4c-g95m-c8cp", "aliases": ["CVE-2025-71332"], "commit": "https://github.com/github/advisory-database/commit/2d4bd9ec59f215311b7e656b111083fc252ac893", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/2d4bd9ec59f215311b7e656b111083fc252ac893/advisories/github-reviewed/2025/04/GHSA-9c4c-g95m-c8cp/GHSA-9c4c-g95m-c8cp.json", "id": "GHSA-9c4c-g95m-c8cp", "packages": ["flowise"], "path": "advisories/github-reviewed/2025/04/GHSA-9c4c-g95m-c8cp/GHSA-9c4c-g95m-c8cp.json", "severity": "HIGH", "status": "changed", "summary": "FlowiseDB vulnerable to SQL Injection by authenticated users"}, {"advisory": "https://github.com/advisories/GHSA-29hf-rm4x-xxph", "aliases": ["CVE-2026-55448"], "commit": "https://github.com/github/advisory-database/commit/b91a7d18bf660e4df3d16ce86ea8a4c5683e1a74", "ecosystems": ["crates.io"], "file": "https://github.com/github/advisory-database/blob/b91a7d18bf660e4df3d16ce86ea8a4c5683e1a74/advisories/github-reviewed/2026/06/GHSA-29hf-rm4x-xxph/GHSA-29hf-rm4x-xxph.json", "id": "GHSA-29hf-rm4x-xxph", "packages": ["mise"], "path": "advisories/github-reviewed/2026/06/GHSA-29hf-rm4x-xxph/GHSA-29hf-rm4x-xxph.json", "severity": "MODERATE", "status": "changed", "summary": "Mise's local credential_command executes untrusted config"}, {"advisory": "https://github.com/advisories/GHSA-gh9r-c94j-cmp5", "aliases": ["CVE-2026-115878"], "commit": "https://github.com/github/advisory-database/commit/17f6aad969d6fbf66d428725d56c65072693f130", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/17f6aad969d6fbf66d428725d56c65072693f130/advisories/github-reviewed/2026/11/GHSA-gh9r-c94j-cmp5/GHSA-gh9r-c94j-cmp5.json", "id": "GHSA-gh9r-c94j-cmp5", "packages": ["stanza"], "path": "advisories/github-reviewed/2026/11/GHSA-gh9r-c94j-cmp5/GHSA-gh9r-c94j-cmp5.json", "severity": "HIGH", "status": "published", "summary": "Stanza: RCE via pickle deserialization in the lemmatizer"}, {"advisory": "https://github.com/advisories/GHSA-68wq-phq7-p2vg", "aliases": ["CVE-2026-55186"], "commit": "https://github.com/github/advisory-database/commit/e283ff073919b1843af36729a333698cb9816520", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/e283ff073919b1843af36729a333698cb9816520/advisories/github-reviewed/2026/10/GHSA-68wq-phq7-p2vg/GHSA-68wq-phq7-p2vg.json", "id": "GHSA-68wq-phq7-p2vg", "packages": ["silverstripe/mfa"], "path": "advisories/github-reviewed/2026/10/GHSA-68wq-phq7-p2vg/GHSA-68wq-phq7-p2vg.json", "severity": "MODERATE", "status": "changed", "summary": "MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow"}, {"advisory": "https://github.com/advisories/GHSA-7pm4-56h2-5rxr", "aliases": ["CVE-2026-5366"], "commit": "https://github.com/github/advisory-database/commit/133ace55605a3f3e9f4331c0643c69660c0efdfa", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/133ace55605a3f3e9f4331c0643c69660c0efdfa/advisories/github-reviewed/2026/06/GHSA-7pm4-56h2-5rxr/GHSA-7pm4-56h2-5rxr.json", "id": "GHSA-7pm4-56h2-5rxr", "packages": ["prefect"], "path": "advisories/github-reviewed/2026/06/GHSA-7pm4-56h2-5rxr/GHSA-7pm4-56h2-5rxr.json", "severity": "CRITICAL", "status": "published", "summary": "Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)"}, {"advisory": "https://github.com/advisories/GHSA-q63x-9pfm-mjx4", "aliases": ["CVE-2026-56121"], "commit": "https://github.com/github/advisory-database/commit/e129255cb37f297a5bc876a9e362d34a443f9d5f", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/e129255cb37f297a5bc876a9e362d34a443f9d5f/advisories/github-reviewed/2026/06/GHSA-q63x-9pfm-mjx4/GHSA-q63x-9pfm-mjx4.json", "id": "GHSA-q63x-9pfm-mjx4", "packages": ["feast"], "path": "advisories/github-reviewed/2026/06/GHSA-q63x-9pfm-mjx4/GHSA-q63x-9pfm-mjx4.json", "severity": "CRITICAL", "status": "changed", "summary": "Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto"}, {"advisory": "https://github.com/advisories/GHSA-qj64-jj84-w38j", "aliases": ["CVE-2026-56091"], "commit": "https://github.com/github/advisory-database/commit/e129255cb37f297a5bc876a9e362d34a443f9d5f", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/e129255cb37f297a5bc876a9e362d34a443f9d5f/advisories/github-reviewed/2026/06/GHSA-qj64-jj84-w38j/GHSA-qj64-jj84-w38j.json", "id": "GHSA-qj64-jj84-w38j", "packages": ["org.apache.shiro:shiro-guice"], "path": "advisories/github-reviewed/2026/06/GHSA-qj64-jj84-w38j/GHSA-qj64-jj84-w38j.json", "severity": "HIGH", "status": "published", "summary": "Apache Shiro shiro-guice module vulnerable to authentication bypass"}, {"advisory": "https://github.com/advisories/GHSA-m8g6-vrr2-x7ff", "aliases": ["CVE-2026-56130"], "commit": "https://github.com/github/advisory-database/commit/acf5bcf01917d2e611bf2966c2e38ee282bc071a", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/acf5bcf01917d2e611bf2966c2e38ee282bc071a/advisories/github-reviewed/2026/06/GHSA-m8g6-vrr2-x7ff/GHSA-m8g6-vrr2-x7ff.json", "id": "GHSA-m8g6-vrr2-x7ff", "packages": ["org.apache.shiro:shiro-core", "org.apache.shiro:shiro-web"], "path": "advisories/github-reviewed/2026/06/GHSA-m8g6-vrr2-x7ff/GHSA-m8g6-vrr2-x7ff.json", "severity": "LOW", "status": "published", "summary": "Apache Shiro's \"remember me\" cookie age is not verified on the server."}, {"advisory": "https://github.com/advisories/GHSA-p2gc-fm5w-94jj", "aliases": ["CVE-2026-66274"], "commit": "https://github.com/github/advisory-database/commit/c84527072ba4f605ae401866e29fb9d00bda7017", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/c84527072ba4f605ae401866e29fb9d00bda7017/advisories/github-reviewed/2026/08/GHSA-p2gc-fm5w-94jj/GHSA-p2gc-fm5w-94jj.json", "id": "GHSA-p2gc-fm5w-94jj", "packages": ["org.apache.qpid:proton-j"], "path": "advisories/github-reviewed/2026/08/GHSA-p2gc-fm5w-94jj/GHSA-p2gc-fm5w-94jj.json", "severity": "HIGH", "status": "changed", "summary": "Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow"}, {"advisory": "https://github.com/advisories/GHSA-57q6-fvp4-pqmm", "aliases": ["CVE-2026-45339"], "commit": "https://github.com/github/advisory-database/commit/54ea6b928d36e4a9a41a26ac072524b191634fd8", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/54ea6b928d36e4a9a41a26ac072524b191634fd8/advisories/github-reviewed/2026/05/GHSA-57q6-fvp4-pqmm/GHSA-57q6-fvp4-pqmm.json", "id": "GHSA-57q6-fvp4-pqmm", "packages": ["open-webui"], "path": "advisories/github-reviewed/2026/05/GHSA-57q6-fvp4-pqmm/GHSA-57q6-fvp4-pqmm.json", "severity": "MODERATE", "status": "changed", "summary": "Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header \u2014 full message processing on restricted endpoints"}, {"advisory": "https://github.com/advisories/GHSA-x6vc-x4v4-hjhr", "aliases": ["CVE-2026-57914"], "commit": "https://github.com/github/advisory-database/commit/f6c6cc756ae0690bde99e87dcfa980246865af49", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/f6c6cc756ae0690bde99e87dcfa980246865af49/advisories/github-reviewed/2026/06/GHSA-x6vc-x4v4-hjhr/GHSA-x6vc-x4v4-hjhr.json", "id": "GHSA-x6vc-x4v4-hjhr", "packages": ["org.apache.kerby:kerby-asn1"], "path": "advisories/github-reviewed/2026/06/GHSA-x6vc-x4v4-hjhr/GHSA-x6vc-x4v4-hjhr.json", "severity": "MODERATE", "status": "changed", "summary": "Apache Kerby vulnerable to denial of service"}, {"advisory": "https://github.com/advisories/GHSA-xrvj-h9w2-3q69", "aliases": ["CVE-2025-55017"], "commit": "https://github.com/github/advisory-database/commit/dfea14d0cd6ad3dab2d1cce70dcc7b978110402a", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/dfea14d0cd6ad3dab2d1cce70dcc7b978110402a/advisories/github-reviewed/2026/06/GHSA-xrvj-h9w2-3q69/GHSA-xrvj-h9w2-3q69.json", "id": "GHSA-xrvj-h9w2-3q69", "packages": ["org.apache.iotdb:iotdb-server"], "path": "advisories/github-reviewed/2026/06/GHSA-xrvj-h9w2-3q69/GHSA-xrvj-h9w2-3q69.json", "severity": "CRITICAL", "status": "published", "summary": "Apache IoTDB has a Path Traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-262p-fj3f-xh7v", "aliases": ["CVE-2026-57915"], "commit": "https://github.com/github/advisory-database/commit/0398025025eda364510f89231e300fc5cea2f1e4", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/0398025025eda364510f89231e300fc5cea2f1e4/advisories/github-reviewed/2026/06/GHSA-262p-fj3f-xh7v/GHSA-262p-fj3f-xh7v.json", "id": "GHSA-262p-fj3f-xh7v", "packages": ["org.apache.kerby:kerb-server"], "path": "advisories/github-reviewed/2026/06/GHSA-262p-fj3f-xh7v/GHSA-262p-fj3f-xh7v.json", "severity": "HIGH", "status": "changed", "summary": "Apache Kerby has a bypass the Kerberos pre-authentication check"}, {"advisory": "https://github.com/advisories/GHSA-h548-jhj8-q85h", "aliases": ["CVE-2025-64152"], "commit": "https://github.com/github/advisory-database/commit/0398025025eda364510f89231e300fc5cea2f1e4", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/0398025025eda364510f89231e300fc5cea2f1e4/advisories/github-reviewed/2026/06/GHSA-h548-jhj8-q85h/GHSA-h548-jhj8-q85h.json", "id": "GHSA-h548-jhj8-q85h", "packages": ["org.apache.iotdb:iotdb-server"], "path": "advisories/github-reviewed/2026/06/GHSA-h548-jhj8-q85h/GHSA-h548-jhj8-q85h.json", "severity": "CRITICAL", "status": "published", "summary": "Apache IoTDB has a Path Traversal vulnerability"}, {"advisory": "https://github.com/advisories/GHSA-72v2-v53v-4qmm", "aliases": ["CVE-2026-13426"], "commit": "https://github.com/github/advisory-database/commit/51487350d8faedb34ce51f2e868bff73324095e9", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/51487350d8faedb34ce51f2e868bff73324095e9/advisories/github-reviewed/2026/06/GHSA-72v2-v53v-4qmm/GHSA-72v2-v53v-4qmm.json", "id": "GHSA-72v2-v53v-4qmm", "packages": ["github.com/mattermost/mattermost/server/public"], "path": "advisories/github-reviewed/2026/06/GHSA-72v2-v53v-4qmm/GHSA-72v2-v53v-4qmm.json", "severity": "MODERATE", "status": "published", "summary": "github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction"}], "sourceId": "advisories-reviewed", "text": "On November 3, 2026, GitHub's security advisory list published 22 new advisories, changed 29, and withdrew 1. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "fullList": {"bytes": 40531, "fingerprint": "59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc", "url": "https://flarereef.flareforward.com/files/watch/59617e259fdbcdd7d92cf809ea96ec72bc100a3aa8723b3f2cde7317c08dabdc.json"}, "noteId": 418, "date": "2026-11-03", "amendmentReason": null}, {"counts": {"changed": 16, "published": 2, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-02", "kind": "watch-day", "recordedAt": "2026-11-03T01:01:39Z", "rows": [{"advisory": "https://github.com/advisories/GHSA-f9j6-8p6x-r9j6", "aliases": ["CVE-2026-62374"], "commit": "https://github.com/github/advisory-database/commit/714474ad30864fbfc71ec0cefc1a454bb23763f9", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/714474ad30864fbfc71ec0cefc1a454bb23763f9/advisories/github-reviewed/2026/11/GHSA-f9j6-8p6x-r9j6/GHSA-f9j6-8p6x-r9j6.json", "id": "GHSA-f9j6-8p6x-r9j6", "packages": ["@sd-jwt/decode", "@sd-jwt/core"], "path": "advisories/github-reviewed/2026/11/GHSA-f9j6-8p6x-r9j6/GHSA-f9j6-8p6x-r9j6.json", "severity": "HIGH", "status": "published", "summary": "SD JWT JS: Tampered disclosures silently dropped instead of rejected"}, {"advisory": "https://github.com/advisories/GHSA-j656-3hf2-fvjc", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c/advisories/github-reviewed/2026/11/GHSA-j656-3hf2-fvjc/GHSA-j656-3hf2-fvjc.json", "id": "GHSA-j656-3hf2-fvjc", "packages": ["@bytebase/dbhub"], "path": "advisories/github-reviewed/2026/11/GHSA-j656-3hf2-fvjc/GHSA-j656-3hf2-fvjc.json", "severity": "MODERATE", "status": "published", "summary": "DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation"}, {"advisory": "https://github.com/advisories/GHSA-593v-wcqx-hq2w", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/fc5d42155fec5ec1d99600e0116af511fb281c9d", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/fc5d42155fec5ec1d99600e0116af511fb281c9d/advisories/github-reviewed/2021/09/GHSA-593v-wcqx-hq2w/GHSA-593v-wcqx-hq2w.json", "id": "GHSA-593v-wcqx-hq2w", "packages": ["parse-server"], "path": "advisories/github-reviewed/2021/09/GHSA-593v-wcqx-hq2w/GHSA-593v-wcqx-hq2w.json", "severity": "HIGH", "status": "changed", "summary": "Incorrect version tags linked to external repository"}, {"advisory": "https://github.com/advisories/GHSA-62gx-5q78-wrvx", "aliases": [], "commit": "https://github.com/github/advisory-database/commit/1d4cd95343cec306ca25af2ff701101a186a82a7", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/1d4cd95343cec306ca25af2ff701101a186a82a7/advisories/github-reviewed/2026/07/GHSA-62gx-5q78-wrvx/GHSA-62gx-5q78-wrvx.json", "id": "GHSA-62gx-5q78-wrvx", "packages": ["obsidian-local-rest-api"], "path": "advisories/github-reviewed/2026/07/GHSA-62gx-5q78-wrvx/GHSA-62gx-5q78-wrvx.json", "severity": "HIGH", "status": "changed", "summary": "obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} \u2014 arbitrary host file read/write/delete"}, {"advisory": "https://github.com/advisories/GHSA-wcjj-9m6g-2fr2", "aliases": ["CVE-2026-59176"], "commit": "https://github.com/github/advisory-database/commit/c99b68a106442b6fa5d954af56dd58c59c4e8617", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/c99b68a106442b6fa5d954af56dd58c59c4e8617/advisories/github-reviewed/2026/09/GHSA-wcjj-9m6g-2fr2/GHSA-wcjj-9m6g-2fr2.json", "id": "GHSA-wcjj-9m6g-2fr2", "packages": ["functype-mcp-server"], "path": "advisories/github-reviewed/2026/09/GHSA-wcjj-9m6g-2fr2/GHSA-wcjj-9m6g-2fr2.json", "severity": "HIGH", "status": "changed", "summary": "functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import"}, {"advisory": "https://github.com/advisories/GHSA-2x63-gw47-w4mm", "aliases": ["CVE-2026-61666"], "commit": "https://github.com/github/advisory-database/commit/b5542e1d1ef8751817ac573f83d4433c852ede80", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/b5542e1d1ef8751817ac573f83d4433c852ede80/advisories/github-reviewed/2026/07/GHSA-2x63-gw47-w4mm/GHSA-2x63-gw47-w4mm.json", "id": "GHSA-2x63-gw47-w4mm", "packages": ["websocket-driver"], "path": "advisories/github-reviewed/2026/07/GHSA-2x63-gw47-w4mm/GHSA-2x63-gw47-w4mm.json", "severity": "HIGH", "status": "changed", "summary": "websocket-driver-ruby: Denial of service via malformed Host header"}, {"advisory": "https://github.com/advisories/GHSA-crwc-vw2r-qr6m", "aliases": ["CVE-2026-113730"], "commit": "https://github.com/github/advisory-database/commit/1e24e5f4b872224ded9288b412cea0b5957cdb5e", "ecosystems": ["Maven"], "file": "https://github.com/github/advisory-database/blob/1e24e5f4b872224ded9288b412cea0b5957cdb5e/advisories/github-reviewed/2026/10/GHSA-crwc-vw2r-qr6m/GHSA-crwc-vw2r-qr6m.json", "id": "GHSA-crwc-vw2r-qr6m", "packages": ["ognl:ognl"], "path": "advisories/github-reviewed/2026/10/GHSA-crwc-vw2r-qr6m/GHSA-crwc-vw2r-qr6m.json", "severity": "MODERATE", "status": "changed", "summary": "OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies"}, {"advisory": "https://github.com/advisories/GHSA-8mgp-746c-j5xp", "aliases": ["CVE-2026-81726"], "commit": "https://github.com/github/advisory-database/commit/fc9a22d2ae88d6a10dda69215596c9400648ba9e", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/fc9a22d2ae88d6a10dda69215596c9400648ba9e/advisories/github-reviewed/2026/09/GHSA-8mgp-746c-j5xp/GHSA-8mgp-746c-j5xp.json", "id": "GHSA-8mgp-746c-j5xp", "packages": ["nltk"], "path": "advisories/github-reviewed/2026/09/GHSA-8mgp-746c-j5xp/GHSA-8mgp-746c-j5xp.json", "severity": "HIGH", "status": "changed", "summary": "NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots"}, {"advisory": "https://github.com/advisories/GHSA-2vqw-3mp8-cgmx", "aliases": ["CVE-2026-47737"], "commit": "https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-2vqw-3mp8-cgmx/GHSA-2vqw-3mp8-cgmx.json", "id": "GHSA-2vqw-3mp8-cgmx", "packages": ["puma"], "path": "advisories/github-reviewed/2026/06/GHSA-2vqw-3mp8-cgmx/GHSA-2vqw-3mp8-cgmx.json", "severity": "HIGH", "status": "changed", "summary": "Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections"}, {"advisory": "https://github.com/advisories/GHSA-qpgp-93vx-g8v8", "aliases": ["CVE-2026-47736"], "commit": "https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3", "ecosystems": ["RubyGems"], "file": "https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-qpgp-93vx-g8v8/GHSA-qpgp-93vx-g8v8.json", "id": "GHSA-qpgp-93vx-g8v8", "packages": ["puma"], "path": "advisories/github-reviewed/2026/06/GHSA-qpgp-93vx-g8v8/GHSA-qpgp-93vx-g8v8.json", "severity": "HIGH", "status": "changed", "summary": "Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion "}, {"advisory": "https://github.com/advisories/GHSA-gm2x-2g9h-ccm8", "aliases": ["CVE-2026-33762"], "commit": "https://github.com/github/advisory-database/commit/cde59b3a8eabd10e036a1898a338bd463ae26b06", "ecosystems": ["Go"], "file": "https://github.com/github/advisory-database/blob/cde59b3a8eabd10e036a1898a338bd463ae26b06/advisories/github-reviewed/2026/03/GHSA-gm2x-2g9h-ccm8/GHSA-gm2x-2g9h-ccm8.json", "id": "GHSA-gm2x-2g9h-ccm8", "packages": ["github.com/go-git/go-git/v5"], "path": "advisories/github-reviewed/2026/03/GHSA-gm2x-2g9h-ccm8/GHSA-gm2x-2g9h-ccm8.json", "severity": "LOW", "status": "changed", "summary": "go-git missing validation decoding Index v4 files leads to panic"}, {"advisory": "https://github.com/advisories/GHSA-79qf-vqgc-7xx3", "aliases": ["CVE-2026-63667"], "commit": "https://github.com/github/advisory-database/commit/bf47def862a58277316e0fb670b9da02328bea6b", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/bf47def862a58277316e0fb670b9da02328bea6b/advisories/github-reviewed/2026/09/GHSA-79qf-vqgc-7xx3/GHSA-79qf-vqgc-7xx3.json", "id": "GHSA-79qf-vqgc-7xx3", "packages": ["@apostrophecms/import-export"], "path": "advisories/github-reviewed/2026/09/GHSA-79qf-vqgc-7xx3/GHSA-79qf-vqgc-7xx3.json", "severity": "MODERATE", "status": "changed", "summary": "ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal"}, {"advisory": "https://github.com/advisories/GHSA-wg36-wvj6-r67p", "aliases": ["CVE-2026-40176"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/04/GHSA-wg36-wvj6-r67p/GHSA-wg36-wvj6-r67p.json", "id": "GHSA-wg36-wvj6-r67p", "packages": ["composer/composer"], "path": "advisories/github-reviewed/2026/04/GHSA-wg36-wvj6-r67p/GHSA-wg36-wvj6-r67p.json", "severity": "HIGH", "status": "changed", "summary": "Composer has a command injection via malicious perforce repository"}, {"advisory": "https://github.com/advisories/GHSA-2p5x-4jr6-x5jg", "aliases": ["CVE-2026-45263"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-2p5x-4jr6-x5jg/GHSA-2p5x-4jr6-x5jg.json", "id": "GHSA-2p5x-4jr6-x5jg", "packages": ["facturascripts/facturascripts"], "path": "advisories/github-reviewed/2026/07/GHSA-2p5x-4jr6-x5jg/GHSA-2p5x-4jr6-x5jg.json", "severity": "HIGH", "status": "changed", "summary": "FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export"}, {"advisory": "https://github.com/advisories/GHSA-5qmh-x653-g8qj", "aliases": ["CVE-2026-45262"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-5qmh-x653-g8qj/GHSA-5qmh-x653-g8qj.json", "id": "GHSA-5qmh-x653-g8qj", "packages": ["facturascripts/facturascripts"], "path": "advisories/github-reviewed/2026/07/GHSA-5qmh-x653-g8qj/GHSA-5qmh-x653-g8qj.json", "severity": "CRITICAL", "status": "changed", "summary": "FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`"}, {"advisory": "https://github.com/advisories/GHSA-hgjx-r89m-m7v4", "aliases": ["CVE-2026-77526"], "commit": "https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8", "ecosystems": ["Packagist"], "file": "https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-hgjx-r89m-m7v4/GHSA-hgjx-r89m-m7v4.json", "id": "GHSA-hgjx-r89m-m7v4", "packages": ["facturascripts/facturascripts"], "path": "advisories/github-reviewed/2026/07/GHSA-hgjx-r89m-m7v4/GHSA-hgjx-r89m-m7v4.json", "severity": "CRITICAL", "status": "changed", "summary": "FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() \u2014 arbitrary file write outside MyFiles/ leading to   RCE"}, {"advisory": "https://github.com/advisories/GHSA-6hcw-qqr8-pjj8", "aliases": ["CVE-2026-40961"], "commit": "https://github.com/github/advisory-database/commit/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964", "ecosystems": ["PyPI"], "file": "https://github.com/github/advisory-database/blob/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964/advisories/github-reviewed/2026/06/GHSA-6hcw-qqr8-pjj8/GHSA-6hcw-qqr8-pjj8.json", "id": "GHSA-6hcw-qqr8-pjj8", "packages": ["apache-airflow"], "path": "advisories/github-reviewed/2026/06/GHSA-6hcw-qqr8-pjj8/GHSA-6hcw-qqr8-pjj8.json", "severity": "HIGH", "status": "changed", "summary": "Apache Airflow: Authenticated users can bypass the `is_safe_url` check"}, {"advisory": "https://github.com/advisories/GHSA-r4q5-vmmm-2653", "aliases": ["CVE-2026-40895"], "commit": "https://github.com/github/advisory-database/commit/5dc5b0acd7f8e64312f23715f299fee0e0b92710", "ecosystems": ["npm"], "file": "https://github.com/github/advisory-database/blob/5dc5b0acd7f8e64312f23715f299fee0e0b92710/advisories/github-reviewed/2026/04/GHSA-r4q5-vmmm-2653/GHSA-r4q5-vmmm-2653.json", "id": "GHSA-r4q5-vmmm-2653", "packages": ["follow-redirects"], "path": "advisories/github-reviewed/2026/04/GHSA-r4q5-vmmm-2653/GHSA-r4q5-vmmm-2653.json", "severity": "MODERATE", "status": "changed", "summary": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets"}], "sourceId": "advisories-reviewed", "text": "On November 2, 2026, GitHub's security advisory list published 2 new advisories, changed 16, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "noteId": 357, "date": "2026-11-02", "amendmentReason": null}, {"counts": {"changed": 0, "published": 0, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-11-01", "kind": "watch-day", "recordedAt": "2026-11-02T01:29:12Z", "rows": [], "sourceId": "advisories-reviewed", "text": "On November 1, 2026, GitHub's security advisory list published 0 new advisories, changed 0, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "noteId": 262, "date": "2026-11-01", "amendmentReason": null}, {"counts": {"changed": 0, "published": 0, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-10-31", "kind": "watch-day", "recordedAt": "2026-11-01T00:49:20Z", "rows": [], "sourceId": "advisories-reviewed", "text": "On October 31, 2026, GitHub's security advisory list published 0 new advisories, changed 0, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "noteId": 212, "date": "2026-10-31", "amendmentReason": null}, {"counts": {"changed": 0, "published": 0, "removed": 0, "withdrawn": 0}, "credit": "Kept by GitHub (github.com/github/advisory-database), shared under CC-BY-4.0.", "day": "2026-10-30", "kind": "watch-day", "recordedAt": "2026-10-31T15:30:31Z", "rows": [], "sourceId": "advisories-reviewed", "text": "On October 30, 2026, GitHub's security advisory list published 0 new advisories, changed 0, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.", "v": 1, "noteId": 209, "date": "2026-10-30", "amendmentReason": null}], "firstCheck": {"noteId": 208, "date": "2026-10-31T14:55:28Z", "text": "First check recorded on October 31, 2026. This record follows GitHub's security advisory list, kept by GitHub at https://github.com/github/advisory-database. Changes before this day are in that history."}}}