Security advisories (GitHub reviewed), as recorded on Flare Reef (https://flarereef.flareforward.com/p/20)

November 2, 2026. On November 2, 2026, GitHub's security advisory list published 2 new advisories, changed 16, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.
GHSA-f9j6-8p6x-r9j6 · published · @sd-jwt/decode · @sd-jwt/core · HIGH · SD JWT JS: Tampered disclosures silently dropped instead of rejected
Advisory: https://github.com/advisories/GHSA-f9j6-8p6x-r9j6
The commit: https://github.com/github/advisory-database/commit/714474ad30864fbfc71ec0cefc1a454bb23763f9
The file: https://github.com/github/advisory-database/blob/714474ad30864fbfc71ec0cefc1a454bb23763f9/advisories/github-reviewed/2026/11/GHSA-f9j6-8p6x-r9j6/GHSA-f9j6-8p6x-r9j6.json
GHSA-j656-3hf2-fvjc · published · @bytebase/dbhub · MODERATE · DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation
Advisory: https://github.com/advisories/GHSA-j656-3hf2-fvjc
The commit: https://github.com/github/advisory-database/commit/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c
The file: https://github.com/github/advisory-database/blob/0d1b1897d1004aa7218f2bd73e2d44d6ddd8ca2c/advisories/github-reviewed/2026/11/GHSA-j656-3hf2-fvjc/GHSA-j656-3hf2-fvjc.json
GHSA-593v-wcqx-hq2w · changed · parse-server · HIGH · Incorrect version tags linked to external repository
Advisory: https://github.com/advisories/GHSA-593v-wcqx-hq2w
The commit: https://github.com/github/advisory-database/commit/fc5d42155fec5ec1d99600e0116af511fb281c9d
The file: https://github.com/github/advisory-database/blob/fc5d42155fec5ec1d99600e0116af511fb281c9d/advisories/github-reviewed/2021/09/GHSA-593v-wcqx-hq2w/GHSA-593v-wcqx-hq2w.json
GHSA-62gx-5q78-wrvx · changed · obsidian-local-rest-api · HIGH · obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete
Advisory: https://github.com/advisories/GHSA-62gx-5q78-wrvx
The commit: https://github.com/github/advisory-database/commit/1d4cd95343cec306ca25af2ff701101a186a82a7
The file: https://github.com/github/advisory-database/blob/1d4cd95343cec306ca25af2ff701101a186a82a7/advisories/github-reviewed/2026/07/GHSA-62gx-5q78-wrvx/GHSA-62gx-5q78-wrvx.json
GHSA-wcjj-9m6g-2fr2 · changed · functype-mcp-server · HIGH · functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import
Advisory: https://github.com/advisories/GHSA-wcjj-9m6g-2fr2
The commit: https://github.com/github/advisory-database/commit/c99b68a106442b6fa5d954af56dd58c59c4e8617
The file: https://github.com/github/advisory-database/blob/c99b68a106442b6fa5d954af56dd58c59c4e8617/advisories/github-reviewed/2026/09/GHSA-wcjj-9m6g-2fr2/GHSA-wcjj-9m6g-2fr2.json
GHSA-2x63-gw47-w4mm · changed · websocket-driver · HIGH · websocket-driver-ruby: Denial of service via malformed Host header
Advisory: https://github.com/advisories/GHSA-2x63-gw47-w4mm
The commit: https://github.com/github/advisory-database/commit/b5542e1d1ef8751817ac573f83d4433c852ede80
The file: https://github.com/github/advisory-database/blob/b5542e1d1ef8751817ac573f83d4433c852ede80/advisories/github-reviewed/2026/07/GHSA-2x63-gw47-w4mm/GHSA-2x63-gw47-w4mm.json
GHSA-crwc-vw2r-qr6m · changed · ognl:ognl · MODERATE · OGNL stricter-invocation block list bypass via java[.]lang[.]reflect reflection proxies
Advisory: https://github.com/advisories/GHSA-crwc-vw2r-qr6m
The commit: https://github.com/github/advisory-database/commit/1e24e5f4b872224ded9288b412cea0b5957cdb5e
The file: https://github.com/github/advisory-database/blob/1e24e5f4b872224ded9288b412cea0b5957cdb5e/advisories/github-reviewed/2026/10/GHSA-crwc-vw2r-qr6m/GHSA-crwc-vw2r-qr6m.json
GHSA-8mgp-746c-j5xp · changed · nltk · HIGH · NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
Advisory: https://github.com/advisories/GHSA-8mgp-746c-j5xp
The commit: https://github.com/github/advisory-database/commit/fc9a22d2ae88d6a10dda69215596c9400648ba9e
The file: https://github.com/github/advisory-database/blob/fc9a22d2ae88d6a10dda69215596c9400648ba9e/advisories/github-reviewed/2026/09/GHSA-8mgp-746c-j5xp/GHSA-8mgp-746c-j5xp.json
GHSA-2vqw-3mp8-cgmx · changed · puma · HIGH · Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
Advisory: https://github.com/advisories/GHSA-2vqw-3mp8-cgmx
The commit: https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3
The file: https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-2vqw-3mp8-cgmx/GHSA-2vqw-3mp8-cgmx.json
GHSA-qpgp-93vx-g8v8 · changed · puma · HIGH · Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion 
Advisory: https://github.com/advisories/GHSA-qpgp-93vx-g8v8
The commit: https://github.com/github/advisory-database/commit/773b286740620f179b9e4b2482e3d8ccfbe1eed3
The file: https://github.com/github/advisory-database/blob/773b286740620f179b9e4b2482e3d8ccfbe1eed3/advisories/github-reviewed/2026/06/GHSA-qpgp-93vx-g8v8/GHSA-qpgp-93vx-g8v8.json
GHSA-gm2x-2g9h-ccm8 · changed · github[.]com/go-git/go-git/v5 · LOW · go-git missing validation decoding Index v4 files leads to panic
Advisory: https://github.com/advisories/GHSA-gm2x-2g9h-ccm8
The commit: https://github.com/github/advisory-database/commit/cde59b3a8eabd10e036a1898a338bd463ae26b06
The file: https://github.com/github/advisory-database/blob/cde59b3a8eabd10e036a1898a338bd463ae26b06/advisories/github-reviewed/2026/03/GHSA-gm2x-2g9h-ccm8/GHSA-gm2x-2g9h-ccm8.json
GHSA-79qf-vqgc-7xx3 · changed · @apostrophecms/import-export · MODERATE · ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
Advisory: https://github.com/advisories/GHSA-79qf-vqgc-7xx3
The commit: https://github.com/github/advisory-database/commit/bf47def862a58277316e0fb670b9da02328bea6b
The file: https://github.com/github/advisory-database/blob/bf47def862a58277316e0fb670b9da02328bea6b/advisories/github-reviewed/2026/09/GHSA-79qf-vqgc-7xx3/GHSA-79qf-vqgc-7xx3.json
GHSA-wg36-wvj6-r67p · changed · composer/composer · HIGH · Composer has a command injection via malicious perforce repository
Advisory: https://github.com/advisories/GHSA-wg36-wvj6-r67p
The commit: https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8
The file: https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/04/GHSA-wg36-wvj6-r67p/GHSA-wg36-wvj6-r67p.json
GHSA-2p5x-4jr6-x5jg · changed · facturascripts/facturascripts · HIGH · FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export
Advisory: https://github.com/advisories/GHSA-2p5x-4jr6-x5jg
The commit: https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8
The file: https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-2p5x-4jr6-x5jg/GHSA-2p5x-4jr6-x5jg.json
GHSA-5qmh-x653-g8qj · changed · facturascripts/facturascripts · CRITICAL · FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
Advisory: https://github.com/advisories/GHSA-5qmh-x653-g8qj
The commit: https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8
The file: https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-5qmh-x653-g8qj/GHSA-5qmh-x653-g8qj.json
GHSA-hgjx-r89m-m7v4 · changed · facturascripts/facturascripts · CRITICAL · FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to   RCE
Advisory: https://github.com/advisories/GHSA-hgjx-r89m-m7v4
The commit: https://github.com/github/advisory-database/commit/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8
The file: https://github.com/github/advisory-database/blob/28fd4f69c91b7ebc7e356df2831a57ed15dd8cd8/advisories/github-reviewed/2026/07/GHSA-hgjx-r89m-m7v4/GHSA-hgjx-r89m-m7v4.json
GHSA-6hcw-qqr8-pjj8 · changed · apache-airflow · HIGH · Apache Airflow: Authenticated users can bypass the `is_safe_url` check
Advisory: https://github.com/advisories/GHSA-6hcw-qqr8-pjj8
The commit: https://github.com/github/advisory-database/commit/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964
The file: https://github.com/github/advisory-database/blob/22ba4e008b452e5157f61fa19cfc3e9e6b6ff964/advisories/github-reviewed/2026/06/GHSA-6hcw-qqr8-pjj8/GHSA-6hcw-qqr8-pjj8.json
GHSA-r4q5-vmmm-2653 · changed · follow-redirects · MODERATE · follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
Advisory: https://github.com/advisories/GHSA-r4q5-vmmm-2653
The commit: https://github.com/github/advisory-database/commit/5dc5b0acd7f8e64312f23715f299fee0e0b92710
The file: https://github.com/github/advisory-database/blob/5dc5b0acd7f8e64312f23715f299fee0e0b92710/advisories/github-reviewed/2026/04/GHSA-r4q5-vmmm-2653/GHSA-r4q5-vmmm-2653.json
Permanent record: https://flarereef.flareforward.com/n/357