November 5, 2026
November 5, 2026
On November 5, 2026, GitHub's security advisory list published 10 new advisories, changed 30, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.
- GHSA-83x9-8wvq-rrcpPyPI · urwid · CRITICAL · Duplicate Advisory: urwid: Insecure PRNG and Information Exposure in Web Display Backend
- GHSA-mgrx-3hqw-485hnpm · flowise · CRITICAL · Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)
- GHSA-xjwq-9jw5-jf7wMaven · org[.]apache[.]activemq:apache-activemq, org[.]apache[.]activemq:activemq-all, org[.]apache[.]activemq:activemq-stomp · HIGH · Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability
- GHSA-j548-68g5-9j7xMaven · org[.]apache[.]activemq:apache-activemq, org[.]apache[.]activemq:activemq-web-console · MODERATE · Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting
- GHSA-mhp6-f224-j2c3Maven · org[.]apache[.]activemq:activemq-broker, org[.]apache[.]activemq:activemq-all, org[.]apache[.]activemq:apache-activemq · HIGH · Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability
- GHSA-rxjr-6c9q-h67xnpm · @logto/tunnel · HIGH · logto-tunnel serves files outside `--experience-path` via path traversal
- GHSA-hhf9-qw4v-72xpGo · github[.]com/canonical/lxd · HIGH · lxd allows Cross-guest volume hijack via DevLXD device patch
- GHSA-c9f5-j9c3-mhrgGo · github[.]com/lxc/incus/v7/cmd/incusd, github[.]com/lxc/incus, github[.]com/lxc/incus/v6, github[.]com/lxc/incus/v7 · HIGH · Incus has a project restriction bypass in instance copy across projects
- GHSA-5q7h-w9jf-cx97Go · github[.]com/chainguard-dev/kaniko · CRITICAL · kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
- GHSA-f2fc-vc88-6w7qnpm · @siteboon/claude-code-ui · CRITICAL · @siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters
- GHSA-64vx-6h2c-rjh7PyPI · banks · HIGH · Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
- GHSA-7ph3-grqh-pv9vMaven · org[.]apache[.]gravitino:catalog-jdbc-common · MODERATE · Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation
- GHSA-m5ph-mmg5-6w5hnpm · filecoin-pin · MODERATE · filecoin-pin: Unbounded DAG pinning can exhaust server resources
- GHSA-cmxg-94mg-jq94npm · @tmlmobilidade/utils · HIGH · @tmlmobilidade/utils has prototype pollution in its setValueAtPath
- GHSA-hggm-x7r9-mm7vnpm · openclaw · HIGH · OpenClaw is vulnerable to Path Traversal through path validation bypass
- GHSA-3jp2-3mrg-2vxcPyPI · oauthlib · HIGH · OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
- GHSA-gxp8-m5rq-3m38npm · qwc2 · MODERATE · QGIS QWC2 Cross-Site Scripting vulnerability
- GHSA-2h2p-mvfx-868wGo · github[.]com/siyuan-note/siyuan/kernel · CRITICAL · SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage
- GHSA-3g9h-9hp4-654vGo · github[.]com/siyuan-note/siyuan/kernel · HIGH · SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass
- GHSA-4j3x-hhg2-fm2xGo · github[.]com/siyuan-note/siyuan/kernel · MODERATE · SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB
- GHSA-56cv-c5p2-j2wgGo · github[.]com/siyuan-note/siyuan/kernel · HIGH · SiYuan has a Full-Read SSRF via /api/network/forwardProxy
- GHSA-vm69-h85x-8p85Go · github[.]com/siyuan-note/siyuan/kernel · MODERATE · SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)
- GHSA-xh5j-727m-w6ggnpm · budibase · HIGH · Budibase vulnerable to SSRF via trivial `.tar[.]gz` substring bypass in Plugin URL upload (`/api/plugin`)
- GHSA-2cm2-m3w5-gp2fnpm · vm2 · MODERATE · vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
- GHSA-c9f5-j9c3-mhrgGo · github[.]com/lxc/incus/v7/cmd/incusd, github[.]com/lxc/incus/v7 · HIGH · Incus has a project restriction bypass in instance copy across projects
- GHSA-v5fq-cf5m-vwv7Packagist · dolibarr/dolibarr · HIGH · Dolibarr has SQL Injection in societe/class/societe[.]class[.]php via localtax1_value parameter
- GHSA-64f3-v33m-w89fGo · github[.]com/lxc/incus/v7, github[.]com/lxc/incus/v6, github[.]com/lxc/incus · HIGH · Incus has a project restriction bypass for custom volume copy across projects
- GHSA-48q5-w887-33wvGo · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has a restricted project bypass leading to arbitrary command execution
- GHSA-73hr-m85f-64v9Go · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has an arbitrary file write on host via `exec-output` symlink in crafted image
- GHSA-wp5r-2gw5-m7q7npm · vm2 · MODERATE · vm2's Transformer Fast-Path Bypass Exposes Internal State Variable
- GHSA-m5w8-4gq2-6f8xnpm · vm2 · CRITICAL · vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
- GHSA-45rp-9p97-h852npm · nocodb · MODERATE · NocoDB Vulnerable to SQL Injection via DATEADD Formula
- GHSA-mpp2-x7wv-38hvnpm · nocodb · LOW · NocoDB has Plaintext Storage of Shared View Passwords
- GHSA-p9x3-w98f-7j3qnpm · nocodb · MODERATE · NocoDB Missing Ownership Validation in MCP Token Operations
- GHSA-x4vh-j75g-268gnpm · nocodb · MODERATE · NocoDB's Refresh Tokens Not Revoked on Password Reset
- GHSA-7prp-2623-8g45PyPI · djust · HIGH · djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
- GHSA-vxp5-584q-c479Go · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has arbitrary file read+write on host via templates/ symlink in malicious image
- GHSA-2q3f-q5pq-g8wvGo · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
- GHSA-v6mj-8pf4-hhw4Go · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has an argument injection in backup compression algorithm leading to AFW and ACE
- GHSA-f6m5-xw2g-xc4xGo · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has an arbitrary file write on its client due to trusted image hash