November 4, 2026
November 4, 2026
On November 4, 2026, GitHub's security advisory list published 17 new advisories, changed 46, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.
- GHSA-7p85-w9px-jpjpPackagist · twig/twig · CRITICAL · Twig: PHP code injection via `{% use %}` template name
- GHSA-659w-93r5-9j6mMaven · org[.]apache[.]opennlp:opennlp-tools · HIGH · Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation
- GHSA-63cw-57p8-fm3pPyPI · torch · HIGH · PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files
- GHSA-xxjr-mmjv-4gpgnpm · lodash, lodash-amd, lodash-es, lodash[.]omit, lodash[.]unset · MODERATE · Lodash has Prototype Pollution Vulnerability in `_[.]unset`, `_[.]omit`, and `_[.]pullAt` functions
- GHSA-mgp5-rv84-w37qMaven · org[.]apache[.]tomcat:tomcat-coyote, org[.]apache[.]tomcat[.]embed:tomcat-embed-core, org[.]apache[.]tomcat:tomcat-coyote-ffm · HIGH · Apache Tomcat has an Improper Input Validation vulnerability
- GHSA-68j8-pq59-fqgmPyPI · nltk · HIGH · NLTK has a Path Traversal issue
- GHSA-3r9x-f23j-gc73PyPI · onnx · HIGH · onnx Vulnerable to Path Traversal via Symlink
- GHSA-469j-vmhf-r6v7PyPI · nltk · HIGH · NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
- GHSA-qr99-7898-vr7cGo · github[.]com/traefik/traefik/v2, github[.]com/traefik/traefik/v3 · MODERATE · Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
- GHSA-p423-j2cm-9vmqPyPI · cryptography · MODERATE · Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
- GHSA-p93r-85wp-75v3Maven · org[.]bouncycastle:bcprov-jdk15to18, org[.]bouncycastle:bcprov-jdk14, org[.]bouncycastle:bcprov-jdk18on · HIGH · Bouncy Castle Has Covert Timing Channel Vulnerability
- GHSA-c3fc-8qff-9hwxMaven · org[.]bouncycastle:bcprov-jdk14, org[.]bouncycastle:bcprov-jdk15to18, org[.]bouncycastle:bcprov-jdk18on · MODERATE · Bouncy Castle has an LDAP injection
- GHSA-v3vg-332r-mw99Maven · org[.]apache[.]camel:camel-pqc · HIGH · Camel-PQC Vulnerable to Deserialization of Untrusted Data
- GHSA-26hh-7cqf-hhc6npm · next · HIGH · Next[.]js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
- GHSA-55hx-c926-fr95npm · vm2 · CRITICAL · VM2 Has a Sandbox Escape Issue via SuppressedError
- GHSA-grj5-jjm8-h35pnpm · vm2 · CRITICAL · VM2 Sandbox Breakout Through __lookupGetter__
- GHSA-v37h-5mfm-c47cnpm · vm2 · CRITICAL · VM2 Has Sandbox Breakout Through Inspect Function
- GHSA-8hg8-63c5-gwmxnpm · vm2 · CRITICAL · vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
- GHSA-9qj6-qjgg-37qqnpm · vm2 · CRITICAL · vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
- GHSA-9vg3-4rfj-wgcmnpm · vm2 · CRITICAL · vm2 has Sandbox Breakout Through Null Proto Exception
- GHSA-vxpw-j846-p89qnpm · undici · HIGH · undici WebSocket client vulnerable to denial of service via fragment count bypass
- GHSA-wp3c-266w-4qfqnpm · js-toml · HIGH · js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
- GHSA-3fxj-6jh8-hvhxGo · github[.]com/go-chi/chi/v5/middleware, github[.]com/go-chi/chi/v5 · MODERATE · chi Has an IP Spoofing Vulnerability in `middleware[.]RealIP`
- GHSA-rp2p-6cmp-jxj9NuGet · Microsoft[.]NetCore[.]App[.]Runtime[.]linux-arm, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-arm64, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-musl-arm, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-musl-arm64, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-musl-x64, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-x64, Microsoft[.]NetCore[.]App[.]Runtime[.]osx-arm64, Microsoft[.]NetCore[.]App[.]Runtime[.]osx-x64 · HIGH · Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
- GHSA-2969-4q4w-w5h3NuGet · Microsoft[.]WindowsDesktop[.]App[.]Runtime[.]win-x64, Microsoft[.]WindowsDesktop[.]App[.]Runtime[.]win-x86, Microsoft[.]WindowsDesktop[.]App[.]Runtime[.]win-arm64 · HIGH · Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability
- GHSA-w7cw-xp7h-6j5jNuGet · Microsoft[.]NetCore[.]App[.]Runtime[.]linux-arm, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-arm64, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-musl-arm, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-musl-arm64, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-musl-x64, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-x64, Microsoft[.]NetCore[.]App[.]Runtime[.]osx-arm64, Microsoft[.]NetCore[.]App[.]Runtime[.]osx-x64, Microsoft[.]NetCore[.]App[.]Runtime[.]win-arm, Microsoft[.]NetCore[.]App[.]Runtime[.]win-arm64, Microsoft[.]NetCore[.]App[.]Runtime[.]win-x64, Microsoft[.]NetCore[.]App[.]Runtime[.]win-x86 · HIGH · Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
- GHSA-wp74-jgxh-gv4qNuGet · Microsoft[.]NetCore[.]App[.]Runtime[.]linux-arm, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-arm64, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-musl-arm, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-musl-arm64, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-musl-x64, Microsoft[.]NetCore[.]App[.]Runtime[.]linux-x64, Microsoft[.]NetCore[.]App[.]Runtime[.]osx-arm64, Microsoft[.]NetCore[.]App[.]Runtime[.]osx-x64, Microsoft[.]NetCore[.]App[.]Runtime[.]win-arm, Microsoft[.]NetCore[.]App[.]Runtime[.]win-arm64, Microsoft[.]NetCore[.]App[.]Runtime[.]win-x64, Microsoft[.]NetCore[.]App[.]Runtime[.]win-x86 · HIGH · Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
- GHSA-2j8r-3c22-8565NuGet · Microsoft[.]DiaSymReader[.]Native · HIGH · Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability
- GHSA-v653-r55g-hcmgcrates[.]io · uv · MODERATE · uv has ZIP payload obfuscation through parsing differentials
- GHSA-h5gm-rvw6-2xpxMaven · org[.]apache[.]activemq:activemq-broker, org[.]apache[.]activemq:apache-activemq, org[.]apache[.]activemq:activemq-all · HIGH · Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability
- GHSA-f892-4h9f-j7g9Maven · org[.]apache[.]activemq:apache-activemq · HIGH · Apache ActiveMQ Improper Authorization vulnerability
- GHSA-7259-vf48-52q3Maven · org[.]apache[.]activemq:activemq-client, org[.]apache[.]activemq:apache-activemq, org[.]apache[.]activemq:activemq-all · HIGH · Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability
- GHSA-9qj4-v6r6-3wmxMaven · org[.]apache[.]activemq:activemq-broker, org[.]apache[.]activemq:apache-activemq, org[.]apache[.]activemq:activemq-all · HIGH · Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability
- GHSA-f77w-px59-cqf5Maven · org[.]apache[.]activemq:apache-activemq, org[.]apache[.]activemq:activemq-all, org[.]apache[.]activemq:activemq-client, org[.]apache[.]activemq:activemq-broker · HIGH · Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability
- GHSA-3cgg-c5pp-57h6npm · odf-kit · MODERATE · odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values
- GHSA-5v3h-fjv2-54fgMaven · org[.]apache[.]tomcat[.]embed:tomcat-embed-core, org[.]apache[.]tomcat:tomcat, org[.]apache[.]tomcat:tomcat-catalina · MODERATE · Apache Tomcat has an Improper Authorization vulnerability
- GHSA-7895-gffq-w6jqMaven · org[.]apache[.]tomcat[.]embed:tomcat-embed-core, org[.]apache[.]tomcat:tomcat, org[.]apache[.]tomcat:tomcat-catalina · HIGH · Apache Tomcat has a Missing Critical Step in Authentication vulnerability
- GHSA-c5ph-rghf-fjfjMaven · org[.]apache[.]tomcat:tomcat, org[.]apache[.]tomcat:tomcat-tribes · MODERATE · Apache Tomcat has an Improper Authentication vulnerability
- GHSA-mqg3-r7h5-24x4Maven · org[.]apache[.]tomcat[.]embed:tomcat-embed-core, org[.]apache[.]tomcat:tomcat, org[.]apache[.]tomcat:tomcat-util-scan · CRITICAL · Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability
- GHSA-h792-v28v-ppgrMaven · org[.]apache[.]tomcat[.]embed:tomcat-embed-core, org[.]apache[.]tomcat:tomcat, org[.]apache[.]tomcat:tomcat-catalina · HIGH · Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability
- GHSA-pg42-rg8c-j886Maven · org[.]apache[.]tomcat:tomcat · MODERATE · Apache Tomcat has a Cross-site Scripting vulnerability
- GHSA-g3hv-75wg-m249npm · minimatch · MODERATE · minimatch has potential denial of service via globparts amplification
- GHSA-mc8m-rr6c-r5qrnpm · @payloadcms/storage-vercel-blob · MODERATE · @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter
- GHSA-93cm-2v4m-c56cGo · github[.]com/basekick-labs/arc · MODERATE · Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735
- GHSA-xq3m-2v4x-88ggnpm · protobufjs · CRITICAL · protobufjs has an arbitrary code execution issue
- GHSA-6f2p-2qg2-qqchGo · github[.]com/kubevirt/kubevirt · LOW · KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption
- GHSA-cgm6-wvp9-4g5hGo · kubevirt[.]io/kubevirt · MODERATE · KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address
- GHSA-q3jc-42cq-33fjGo · kubevirt[.]io/kubevirt · MODERATE · KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite
- GHSA-7g64-f2hm-vjxpMaven · io[.]apicurio:apicurio-registry-schema-util-common · HIGH · Apicurio Registry utilities allow SSRF and denial of service through XML parsing
- GHSA-rcmh-vfq7-8gf4Maven · io[.]apicurio:apicurio-registry-schema-util-wsdl · HIGH · Apicurio Registry allows upload of WSDL raising HTTP request
- GHSA-748j-wm96-4wh5Maven · io[.]apicurio:apicurio-registry-schema-util-xml · MODERATE · Apicurio Registry is vulnerable to denial of service through XML entity expansion
- GHSA-vqqj-9cmv-hx43Maven · io[.]undertow:undertow-core · HIGH · Undertow is Vulnerable to HTTP Request/Response Smuggling
- GHSA-3gv6-g396-9v4rMaven · io[.]undertow:undertow-core · HIGH · Undertow is Vulnerable to HTTP Request/Response Smuggling
- GHSA-8v4x-mgvp-p658Maven · io[.]undertow:undertow-core · HIGH · Undertow is Vulnerable to HTTP Request/Response Smuggling
- GHSA-cpm7-cfpx-3hvpMaven · gov[.]nsa[.]emissary:emissary · MODERATE · Emissary has Stored XSS via Navigation Template Link Injection
- GHSA-6c37-7w4p-jg9vMaven · gov[.]nsa[.]emissary:emissary · HIGH · Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
- GHSA-3p24-9x7v-7789Maven · gov[.]nsa[.]emissary:emissary · HIGH · Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
- GHSA-c6q7-wqw2-h65wMaven · gov[.]nsa[.]emissary:emissary · MODERATE · NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571
- GHSA-p3fp-8748-vqfqPyPI · Django · MODERATE · Django Vulnerable to Allocation of Resources Without Limits or Throttling
- GHSA-8fcf-v89g-xpg6Go · github[.]com/traefik/traefik/v3, github[.]com/traefik/traefik · MODERATE · Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
- GHSA-gfjv-gqf2-c888Go · github[.]com/gardener/gardener · MODERATE · Gardener: Authorization Bypass via Group Subject Injection
- GHSA-fjwv-jf2v-j499Go · github[.]com/hatchet-dev/hatchet · MODERATE · Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler
- GHSA-phg3-3g28-wq9vGo · github[.]com/hatchet-dev/hatchet · HIGH · Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState