November 2, 2026

November 2, 2026

On November 2, 2026, GitHub's security advisory list published 2 new advisories, changed 16, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.

• GHSA-f9j6-8p6x-r9j6
  npm · @sd-jwt/decode, @sd-jwt/core · HIGH · SD JWT JS: Tampered disclosures silently dropped instead of rejected
  Advisory · The commit · The file
• GHSA-j656-3hf2-fvjc
  npm · @bytebase/dbhub · MODERATE · DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation
  Advisory · The commit · The file
• GHSA-593v-wcqx-hq2w
  npm · parse-server · HIGH · Incorrect version tags linked to external repository
  Advisory · The commit · The file
• GHSA-62gx-5q78-wrvx
  npm · obsidian-local-rest-api · HIGH · obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete
  Advisory · The commit · The file
• GHSA-wcjj-9m6g-2fr2
  npm · functype-mcp-server · HIGH · functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import
  Advisory · The commit · The file
• GHSA-2x63-gw47-w4mm
  RubyGems · websocket-driver · HIGH · websocket-driver-ruby: Denial of service via malformed Host header
  Advisory · The commit · The file
• GHSA-crwc-vw2r-qr6m
  Maven · ognl:ognl · MODERATE · OGNL stricter-invocation block list bypass via java[.]lang[.]reflect reflection proxies
  Advisory · The commit · The file
• GHSA-8mgp-746c-j5xp
  PyPI · nltk · HIGH · NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
  Advisory · The commit · The file
• GHSA-2vqw-3mp8-cgmx
  RubyGems · puma · HIGH · Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
  Advisory · The commit · The file
• GHSA-qpgp-93vx-g8v8
  RubyGems · puma · HIGH · Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
  Advisory · The commit · The file
• GHSA-gm2x-2g9h-ccm8
  Go · github[.]com/go-git/go-git/v5 · LOW · go-git missing validation decoding Index v4 files leads to panic
  Advisory · The commit · The file
• GHSA-79qf-vqgc-7xx3
  npm · @apostrophecms/import-export · MODERATE · ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
  Advisory · The commit · The file
• GHSA-wg36-wvj6-r67p
  Packagist · composer/composer · HIGH · Composer has a command injection via malicious perforce repository
  Advisory · The commit · The file
• GHSA-2p5x-4jr6-x5jg
  Packagist · facturascripts/facturascripts · HIGH · FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
  Advisory · The commit · The file
• GHSA-5qmh-x653-g8qj
  Packagist · facturascripts/facturascripts · CRITICAL · FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
  Advisory · The commit · The file
• GHSA-hgjx-r89m-m7v4
  Packagist · facturascripts/facturascripts · CRITICAL · FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE
  Advisory · The commit · The file
• GHSA-6hcw-qqr8-pjj8
  PyPI · apache-airflow · HIGH · Apache Airflow: Authenticated users can bypass the `is_safe_url` check
  Advisory · The commit · The file
• GHSA-r4q5-vmmm-2653
  npm · follow-redirects · MODERATE · follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
  Advisory · The commit · The file

Permanent record