November 3, 2026
November 3, 2026
On November 3, 2026, GitHub's security advisory list published 22 new advisories, changed 29, and withdrew 1. A security advisory is a public warning about a hole in a piece of software.
- GHSA-wp3j-xq48-xpjwGo · github[.]com/containers/podman/v5, github[.]com/containers/podman/v4 · HIGH · podman kube play symlink traversal vulnerability
- GHSA-v653-r55g-hcmgcrates[.]io · uv · MODERATE · uv has ZIP payload obfuscation through parsing differentials
- GHSA-f23m-r3pf-42rhnpm · lodash, lodash-es, lodash-amd, lodash[.]unset, lodash[.]omit · MODERATE · lodash vulnerable to prototype pollution via array-path bypass in `_[.]unset`, `_[.]omit`, and `_[.]pullAt
- GHSA-2cvf-wqm6-wr9gGo · github[.]com/containers/podman/v4, go[.]podman[.]io/podman/v6, github[.]com/containers/podman/v5 · CRITICAL · Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
- GHSA-23f4-hfmq-94mjMaven · com[.]github[.]liuyueyi[.]media:batik-codec-fix · MODERATE · Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec
- GHSA-4c5c-2vc3-x5w2PyPI · vantage6 · MODERATE · Vantage6: 2FA can be circumvented with hacked email access
- GHSA-5549-c5q7-fj65PyPI · vantage6 · LOW · Vantage6: No limit on emails sent for password/MFA reset
- GHSA-gg2p-37pv-v7fqPyPI · feast · CRITICAL · Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs
- GHSA-263q-5cv3-xq9gGo · code[.]gitea[.]io/gitea · HIGH · Gitea allows attackers to add attachments with forbidden file extensions
- GHSA-2fqr-mr3j-6wp8PyPI · aiohttp · LOW · aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
- GHSA-m3qr-fvp4-78xjGo · github[.]com/basekick-labs/arc · LOW · Arc has unauthenticated application log disclosure via `/api/v1/logs`
- GHSA-h26j-4vp7-x9w2NuGet · Metalama[.]Framework · HIGH · Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution
- GHSA-9ppr-wfw9-xvr2Go · github[.]com/tinfoil-factory/netfoil · MODERATE · Netfoil doesn't decrement TTL
- GHSA-g27p-qf6j-c96cNuGet · Microsoft[.]AspNetCore[.]Components[.]WebAssembly[.]Server · HIGH · Microsoft Security Advisory CVE-2026-102870 - ASP[.]NET Core Remote Code Execution Vulnerability
- GHSA-4mpw-cpwj-hxxjNuGet · Microsoft[.]NETCore[.]App[.]Runtime[.]win-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]win-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86 · HIGH · Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability
- GHSA-9v8h-qqgm-4m35PyPI · brotli, brotlicffi · CRITICAL · Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
- GHSA-g27p-qf6j-c96cNuGet · Microsoft[.]AspNetCore[.]Components[.]WebAssembly[.]Server · HIGH · Microsoft Security Advisory CVE-2026-102870 - ASP[.]NET Core Remote Code Execution Vulnerability
- GHSA-gqj5-2xp5-3qmpMaven · org[.]keycloak:keycloak-services · HIGH · Duplicate Advisory: Authentication bypass via jwt algorithm confusion
- GHSA-48v2-6jcm-fc99Go · github[.]com/mtzanidakis/praktor · HIGH · praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)
- GHSA-j97h-3f8r-mrjrMaven · org[.]keycloak:keycloak-services · HIGH · Keycloak has authentication bypass via jwt algorithm confusion
- GHSA-p3jp-9v83-76w9NuGet · Microsoft[.]DotNet[.]ILCompiler, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]ios-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]iossimulator-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]iossimulator-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]linux-bionic-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]linux-bionic-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]maccatalyst-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]maccatalyst-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]osx-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]osx-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]tvos-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]tvossimulator-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]tvossimulator-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]LLVM[.]linux-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]LLVM[.]linux-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]LLVM[.]osx-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]android-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]android-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]android-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]android-x86, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]browser-wasm, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]ios-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]iossimulator-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]iossimulator-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]linux-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]linux-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]linux-musl-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]linux-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]maccatalyst-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]maccatalyst-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]multithread[.]browser-wasm, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]osx-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]osx-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]tvos-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]tvossimulator-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]tvossimulator-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]wasi-wasm, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]win-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]Mono[.]win-x86, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-bionic-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-bionic-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-musl-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-musl-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-musl-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]osx-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]osx-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]win-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]win-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]linux-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]linux-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]linux-bionic-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]linux-musl-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]linux-musl-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]linux-musl-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]linux-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]win-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]win-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]win-x86, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]android-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]android-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]NativeAOT[.]android-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]android-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]android-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]android-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]browser-wasm, Microsoft[.]NETCore[.]App[.]Runtime[.]ios-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]iossimulator-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]iossimulator-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]maccatalyst-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]maccatalyst-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]tvos-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]tvossimulator-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]tvossimulator-x64 · HIGH · Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability
- GHSA-8vvx-qvq9-5948npm · flowise · CRITICAL · Flowise allows arbitrary file write to RCE
- GHSA-3gf5-cxq9-w223PyPI · picklescan · HIGH · Picklescan is missing detection when calling built-in python idlelib[.]pyshell[.]ModifiedInterpreter[.]runcode
- GHSA-6933-jpx5-q87qnpm · flowise · CRITICAL · Flowise has unsandboxed remote code execution via Custom MCP
- GHSA-q67q-549q-p849npm · flowise · CRITICAL · Flowise has arbitrary file access due to missing chat flow id validation
- GHSA-273h-m46v-96q4NuGet · Magick[.]NET-Q16-AnyCPU, Magick[.]NET-Q16-HDRI-AnyCPU, Magick[.]NET-Q16-HDRI-OpenMP-arm64, Magick[.]NET-Q16-HDRI-OpenMP-x64, Magick[.]NET-Q16-HDRI-arm64, Magick[.]NET-Q16-HDRI-x64, Magick[.]NET-Q16-HDRI-x86, Magick[.]NET-Q16-OpenMP-arm64, Magick[.]NET-Q16-OpenMP-x64, Magick[.]NET-Q16-OpenMP-x86, Magick[.]NET-Q16-arm64, Magick[.]NET-Q16-x64, Magick[.]NET-Q16-x86, Magick[.]NET-Q8-AnyCPU, Magick[.]NET-Q8-OpenMP-arm64, Magick[.]NET-Q8-OpenMP-x64, Magick[.]NET-Q8-arm64, Magick[.]NET-Q8-x64, Magick[.]NET-Q8-x86 · LOW · ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
- GHSA-c3hj-m5hq-59xwnpm · flowise · CRITICAL · Duplicate Advisory : Flowise allows arbitrary file write to RCE
- GHSA-mq7r-vm99-p7vxPyPI · picklescan · HIGH · Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib[.]pyshell[.]ModifiedInterpreter[.]runcode
- GHSA-q2xp-j85q-883hnpm · flowise · CRITICAL · Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP
- GHSA-rg39-4fm5-hrp2NuGet · Magick[.]NET-Q8-x86 · MODERATE · Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
- GHSA-w5r9-j49j-2m55npm · flowise · CRITICAL · Duplicate Advisory : Flowise has arbitrary file access due to missing chat flow id validation
- GHSA-q2hg-643c-gw8hPyPI · apache-airflow · HIGH · Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag
- GHSA-x9rp-7wh3-2rj5npm · @enspirit/elo · HIGH · Elo backends have code injection via unvalidated emission of programmatic AST fields
- GHSA-33r5-xmm8-v6x5npm · @enspirit/elo · CRITICAL · Elo JavaScript emitter has sandbox escape to arbitrary Node[.]js / browser code execution via unfiltered `.constructor` member access
- GHSA-7w38-ggh5-v542npm · @enspirit/elo · CRITICAL · Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
- GHSA-m9cv-24rx-8mv7Packagist · filament/forms · HIGH · Filament: Disabled RichEditor field state can be used for XSS
- GHSA-q6r4-3wmg-fwcqGo · github[.]com/containers/podman/v5, github[.]com/containers/podman/v4, github[.]com/containers/podman/v3 · MODERATE · Podman: WORKDIR symlink traversal vulnerability
- GHSA-9c4c-g95m-c8cpnpm · flowise · HIGH · FlowiseDB vulnerable to SQL Injection by authenticated users
- GHSA-29hf-rm4x-xxphcrates[.]io · mise · MODERATE · Mise's local credential_command executes untrusted config
- GHSA-gh9r-c94j-cmp5PyPI · stanza · HIGH · Stanza: RCE via pickle deserialization in the lemmatizer
- GHSA-68wq-phq7-p2vgPackagist · silverstripe/mfa · MODERATE · MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
- GHSA-7pm4-56h2-5rxrPyPI · prefect · CRITICAL · Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)
- GHSA-q63x-9pfm-mjx4PyPI · feast · CRITICAL · Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto
- GHSA-qj64-jj84-w38jMaven · org[.]apache[.]shiro:shiro-guice · HIGH · Apache Shiro shiro-guice module vulnerable to authentication bypass
- GHSA-m8g6-vrr2-x7ffMaven · org[.]apache[.]shiro:shiro-core, org[.]apache[.]shiro:shiro-web · LOW · Apache Shiro's "remember me" cookie age is not verified on the server.
- GHSA-p2gc-fm5w-94jjMaven · org[.]apache[.]qpid:proton-j · HIGH · Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
- GHSA-57q6-fvp4-pqmmPyPI · open-webui · MODERATE · Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
- GHSA-x6vc-x4v4-hjhrMaven · org[.]apache[.]kerby:kerby-asn1 · MODERATE · Apache Kerby vulnerable to denial of service
- GHSA-xrvj-h9w2-3q69Maven · org[.]apache[.]iotdb:iotdb-server · CRITICAL · Apache IoTDB has a Path Traversal vulnerability
- GHSA-262p-fj3f-xh7vMaven · org[.]apache[.]kerby:kerb-server · HIGH · Apache Kerby has a bypass the Kerberos pre-authentication check
- GHSA-h548-jhj8-q85hMaven · org[.]apache[.]iotdb:iotdb-server · CRITICAL · Apache IoTDB has a Path Traversal vulnerability
- GHSA-72v2-v53v-4qmmGo · github[.]com/mattermost/mattermost/server/public · MODERATE · github[.]com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction