Security advisories (GitHub reviewed), as recorded on Flare Reef (https://flarereef.flareforward.com/p/20)

November 5, 2026. On November 5, 2026, GitHub's security advisory list published 10 new advisories, changed 30, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.
GHSA-83x9-8wvq-rrcp · published · urwid · CRITICAL · Duplicate Advisory: urwid: Insecure PRNG and Information Exposure in Web Display Backend
Advisory: https://github.com/advisories/GHSA-83x9-8wvq-rrcp
The commit: https://github.com/github/advisory-database/commit/dad68de093963b3b1162ed904cfde9ba86ce90a2
The file: https://github.com/github/advisory-database/blob/dad68de093963b3b1162ed904cfde9ba86ce90a2/advisories/github-reviewed/2026/07/GHSA-83x9-8wvq-rrcp/GHSA-83x9-8wvq-rrcp.json
GHSA-mgrx-3hqw-485h · published · flowise · CRITICAL · Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)
Advisory: https://github.com/advisories/GHSA-mgrx-3hqw-485h
The commit: https://github.com/github/advisory-database/commit/75d28f77c8c68c601120dde65f74a52dab4d9a25
The file: https://github.com/github/advisory-database/blob/75d28f77c8c68c601120dde65f74a52dab4d9a25/advisories/github-reviewed/2026/09/GHSA-mgrx-3hqw-485h/GHSA-mgrx-3hqw-485h.json
GHSA-xjwq-9jw5-jf7w · published · org[.]apache[.]activemq:apache-activemq · org[.]apache[.]activemq:activemq-all · org[.]apache[.]activemq:activemq-stomp · HIGH · Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability
Advisory: https://github.com/advisories/GHSA-xjwq-9jw5-jf7w
The commit: https://github.com/github/advisory-database/commit/f0982c3e3f1a9aaf55d09af61bc2a82243d60114
The file: https://github.com/github/advisory-database/blob/f0982c3e3f1a9aaf55d09af61bc2a82243d60114/advisories/github-reviewed/2026/06/GHSA-xjwq-9jw5-jf7w/GHSA-xjwq-9jw5-jf7w.json
GHSA-j548-68g5-9j7x · published · org[.]apache[.]activemq:apache-activemq · org[.]apache[.]activemq:activemq-web-console · MODERATE · Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting
Advisory: https://github.com/advisories/GHSA-j548-68g5-9j7x
The commit: https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a
The file: https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/06/GHSA-j548-68g5-9j7x/GHSA-j548-68g5-9j7x.json
GHSA-mhp6-f224-j2c3 · published · org[.]apache[.]activemq:activemq-broker · org[.]apache[.]activemq:activemq-all · org[.]apache[.]activemq:apache-activemq · HIGH · Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability
Advisory: https://github.com/advisories/GHSA-mhp6-f224-j2c3
The commit: https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a
The file: https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/06/GHSA-mhp6-f224-j2c3/GHSA-mhp6-f224-j2c3.json
GHSA-rxjr-6c9q-h67x · changed · @logto/tunnel · HIGH · logto-tunnel serves files outside `--experience-path` via path traversal
Advisory: https://github.com/advisories/GHSA-rxjr-6c9q-h67x
The commit: https://github.com/github/advisory-database/commit/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a
The file: https://github.com/github/advisory-database/blob/b0a9f5fae33bcbb4d06322e38c1c77a05be1c91a/advisories/github-reviewed/2026/08/GHSA-rxjr-6c9q-h67x/GHSA-rxjr-6c9q-h67x.json
GHSA-hhf9-qw4v-72xp · published · github[.]com/canonical/lxd · HIGH · lxd allows Cross-guest volume hijack via DevLXD device patch
Advisory: https://github.com/advisories/GHSA-hhf9-qw4v-72xp
The commit: https://github.com/github/advisory-database/commit/ea5c37f32656932910a20139055ba87f3feabada
The file: https://github.com/github/advisory-database/blob/ea5c37f32656932910a20139055ba87f3feabada/advisories/github-reviewed/2026/11/GHSA-hhf9-qw4v-72xp/GHSA-hhf9-qw4v-72xp.json
GHSA-c9f5-j9c3-mhrg · changed · github[.]com/lxc/incus/v7/cmd/incusd · github[.]com/lxc/incus · github[.]com/lxc/incus/v6 · github[.]com/lxc/incus/v7 · HIGH · Incus has a project restriction bypass in instance copy across projects
Advisory: https://github.com/advisories/GHSA-c9f5-j9c3-mhrg
The commit: https://github.com/github/advisory-database/commit/c8e404abeae21b3533043f93aad3209f563804ee
The file: https://github.com/github/advisory-database/blob/c8e404abeae21b3533043f93aad3209f563804ee/advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json
GHSA-5q7h-w9jf-cx97 · published · github[.]com/chainguard-dev/kaniko · CRITICAL · kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
Advisory: https://github.com/advisories/GHSA-5q7h-w9jf-cx97
The commit: https://github.com/github/advisory-database/commit/11e4da6bbb9646baa1b1b5637faaa51f28d89ee1
The file: https://github.com/github/advisory-database/blob/11e4da6bbb9646baa1b1b5637faaa51f28d89ee1/advisories/github-reviewed/2026/11/GHSA-5q7h-w9jf-cx97/GHSA-5q7h-w9jf-cx97.json
GHSA-f2fc-vc88-6w7q · changed · @siteboon/claude-code-ui · CRITICAL · @siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters
Advisory: https://github.com/advisories/GHSA-f2fc-vc88-6w7q
The commit: https://github.com/github/advisory-database/commit/a15b10a067194389c69e2cbb263f71863a619102
The file: https://github.com/github/advisory-database/blob/a15b10a067194389c69e2cbb263f71863a619102/advisories/github-reviewed/2026/03/GHSA-f2fc-vc88-6w7q/GHSA-f2fc-vc88-6w7q.json
GHSA-64vx-6h2c-rjh7 · published · banks · HIGH · Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
Advisory: https://github.com/advisories/GHSA-64vx-6h2c-rjh7
The commit: https://github.com/github/advisory-database/commit/a15b10a067194389c69e2cbb263f71863a619102
The file: https://github.com/github/advisory-database/blob/a15b10a067194389c69e2cbb263f71863a619102/advisories/github-reviewed/2026/11/GHSA-64vx-6h2c-rjh7/GHSA-64vx-6h2c-rjh7.json
GHSA-7ph3-grqh-pv9v · published · org[.]apache[.]gravitino:catalog-jdbc-common · MODERATE · Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation
Advisory: https://github.com/advisories/GHSA-7ph3-grqh-pv9v
The commit: https://github.com/github/advisory-database/commit/ed8973f214955efede5aaa44b424ffff995fe788
The file: https://github.com/github/advisory-database/blob/ed8973f214955efede5aaa44b424ffff995fe788/advisories/github-reviewed/2026/06/GHSA-7ph3-grqh-pv9v/GHSA-7ph3-grqh-pv9v.json
GHSA-m5ph-mmg5-6w5h · published · filecoin-pin · MODERATE · filecoin-pin: Unbounded DAG pinning can exhaust server resources
Advisory: https://github.com/advisories/GHSA-m5ph-mmg5-6w5h
The commit: https://github.com/github/advisory-database/commit/e907c7fd8845f48fe93445783d1b20c0cc128185
The file: https://github.com/github/advisory-database/blob/e907c7fd8845f48fe93445783d1b20c0cc128185/advisories/github-reviewed/2026/11/GHSA-m5ph-mmg5-6w5h/GHSA-m5ph-mmg5-6w5h.json
GHSA-cmxg-94mg-jq94 · changed · @tmlmobilidade/utils · HIGH · @tmlmobilidade/utils has prototype pollution in its setValueAtPath
Advisory: https://github.com/advisories/GHSA-cmxg-94mg-jq94
The commit: https://github.com/github/advisory-database/commit/6d172d33d09e2e30f62cada7169acce533f3a939
The file: https://github.com/github/advisory-database/blob/6d172d33d09e2e30f62cada7169acce533f3a939/advisories/github-reviewed/2026/05/GHSA-cmxg-94mg-jq94/GHSA-cmxg-94mg-jq94.json
GHSA-hggm-x7r9-mm7v · changed · openclaw · HIGH · OpenClaw is vulnerable to Path Traversal through path validation bypass
Advisory: https://github.com/advisories/GHSA-hggm-x7r9-mm7v
The commit: https://github.com/github/advisory-database/commit/8a02b848107f1d1bc75f077d96c09423d1d80890
The file: https://github.com/github/advisory-database/blob/8a02b848107f1d1bc75f077d96c09423d1d80890/advisories/github-reviewed/2026/03/GHSA-hggm-x7r9-mm7v/GHSA-hggm-x7r9-mm7v.json
GHSA-3jp2-3mrg-2vxc · changed · oauthlib · HIGH · OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
Advisory: https://github.com/advisories/GHSA-3jp2-3mrg-2vxc
The commit: https://github.com/github/advisory-database/commit/015b4ac6fc6c3d7a2e8cfe351f3d75c80fe5355c
The file: https://github.com/github/advisory-database/blob/015b4ac6fc6c3d7a2e8cfe351f3d75c80fe5355c/advisories/github-reviewed/2026/10/GHSA-3jp2-3mrg-2vxc/GHSA-3jp2-3mrg-2vxc.json
GHSA-gxp8-m5rq-3m38 · changed · qwc2 · MODERATE · QGIS QWC2 Cross-Site Scripting vulnerability
Advisory: https://github.com/advisories/GHSA-gxp8-m5rq-3m38
The commit: https://github.com/github/advisory-database/commit/2fd074d93c15dd5b3f942200aca4ab022c5940a8
The file: https://github.com/github/advisory-database/blob/2fd074d93c15dd5b3f942200aca4ab022c5940a8/advisories/github-reviewed/2025/10/GHSA-gxp8-m5rq-3m38/GHSA-gxp8-m5rq-3m38.json
GHSA-2h2p-mvfx-868w · changed · github[.]com/siyuan-note/siyuan/kernel · CRITICAL · SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage
Advisory: https://github.com/advisories/GHSA-2h2p-mvfx-868w
The commit: https://github.com/github/advisory-database/commit/865ad3719da80c9fa4749db2ca509fc96c3ee201
The file: https://github.com/github/advisory-database/blob/865ad3719da80c9fa4749db2ca509fc96c3ee201/advisories/github-reviewed/2026/03/GHSA-2h2p-mvfx-868w/GHSA-2h2p-mvfx-868w.json
GHSA-3g9h-9hp4-654v · changed · github[.]com/siyuan-note/siyuan/kernel · HIGH · SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass
Advisory: https://github.com/advisories/GHSA-3g9h-9hp4-654v
The commit: https://github.com/github/advisory-database/commit/f1653eb81183a4d28ae04bdb386ee6f1edb45682
The file: https://github.com/github/advisory-database/blob/f1653eb81183a4d28ae04bdb386ee6f1edb45682/advisories/github-reviewed/2026/03/GHSA-3g9h-9hp4-654v/GHSA-3g9h-9hp4-654v.json
GHSA-4j3x-hhg2-fm2x · changed · github[.]com/siyuan-note/siyuan/kernel · MODERATE · SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB
Advisory: https://github.com/advisories/GHSA-4j3x-hhg2-fm2x
The commit: https://github.com/github/advisory-database/commit/c8f7bc8c64a0164ad1d3cf7dd3f625fff5abb7d6
The file: https://github.com/github/advisory-database/blob/c8f7bc8c64a0164ad1d3cf7dd3f625fff5abb7d6/advisories/github-reviewed/2026/03/GHSA-4j3x-hhg2-fm2x/GHSA-4j3x-hhg2-fm2x.json
GHSA-56cv-c5p2-j2wg · changed · github[.]com/siyuan-note/siyuan/kernel · HIGH · SiYuan has a Full-Read SSRF via /api/network/forwardProxy
Advisory: https://github.com/advisories/GHSA-56cv-c5p2-j2wg
The commit: https://github.com/github/advisory-database/commit/3f84de2bbfab5e2cb56a797dc36ee60d378de9c4
The file: https://github.com/github/advisory-database/blob/3f84de2bbfab5e2cb56a797dc36ee60d378de9c4/advisories/github-reviewed/2026/03/GHSA-56cv-c5p2-j2wg/GHSA-56cv-c5p2-j2wg.json
GHSA-vm69-h85x-8p85 · changed · github[.]com/siyuan-note/siyuan/kernel · MODERATE · SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)
Advisory: https://github.com/advisories/GHSA-vm69-h85x-8p85
The commit: https://github.com/github/advisory-database/commit/3c6eaabfbdde2e6a3b9d26701f3ce718f6f77267
The file: https://github.com/github/advisory-database/blob/3c6eaabfbdde2e6a3b9d26701f3ce718f6f77267/advisories/github-reviewed/2026/03/GHSA-vm69-h85x-8p85/GHSA-vm69-h85x-8p85.json
GHSA-xh5j-727m-w6gg · changed · budibase · HIGH · Budibase vulnerable to SSRF via trivial `.tar[.]gz` substring bypass in Plugin URL upload (`/api/plugin`)
Advisory: https://github.com/advisories/GHSA-xh5j-727m-w6gg
The commit: https://github.com/github/advisory-database/commit/a078f9080b4bb1f9fcd3a8e04759dac640d7694a
The file: https://github.com/github/advisory-database/blob/a078f9080b4bb1f9fcd3a8e04759dac640d7694a/advisories/github-reviewed/2026/05/GHSA-xh5j-727m-w6gg/GHSA-xh5j-727m-w6gg.json
GHSA-2cm2-m3w5-gp2f · changed · vm2 · MODERATE · vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
Advisory: https://github.com/advisories/GHSA-2cm2-m3w5-gp2f
The commit: https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f
The file: https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/05/GHSA-2cm2-m3w5-gp2f/GHSA-2cm2-m3w5-gp2f.json
GHSA-c9f5-j9c3-mhrg · changed · github[.]com/lxc/incus/v7/cmd/incusd · github[.]com/lxc/incus/v7 · HIGH · Incus has a project restriction bypass in instance copy across projects
Advisory: https://github.com/advisories/GHSA-c9f5-j9c3-mhrg
The commit: https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f
The file: https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/08/GHSA-c9f5-j9c3-mhrg/GHSA-c9f5-j9c3-mhrg.json
GHSA-v5fq-cf5m-vwv7 · changed · dolibarr/dolibarr · HIGH · Dolibarr has SQL Injection in societe/class/societe[.]class[.]php via localtax1_value parameter
Advisory: https://github.com/advisories/GHSA-v5fq-cf5m-vwv7
The commit: https://github.com/github/advisory-database/commit/d37964cc217b0e98fda23defd53c28a02336001f
The file: https://github.com/github/advisory-database/blob/d37964cc217b0e98fda23defd53c28a02336001f/advisories/github-reviewed/2026/10/GHSA-v5fq-cf5m-vwv7/GHSA-v5fq-cf5m-vwv7.json
GHSA-64f3-v33m-w89f · changed · github[.]com/lxc/incus/v7 · github[.]com/lxc/incus/v6 · github[.]com/lxc/incus · HIGH · Incus has a project restriction bypass for custom volume copy across projects
Advisory: https://github.com/advisories/GHSA-64f3-v33m-w89f
The commit: https://github.com/github/advisory-database/commit/791a7d38dba2f98458199d10ad2cc55304c3d3d4
The file: https://github.com/github/advisory-database/blob/791a7d38dba2f98458199d10ad2cc55304c3d3d4/advisories/github-reviewed/2026/08/GHSA-64f3-v33m-w89f/GHSA-64f3-v33m-w89f.json
GHSA-48q5-w887-33wv · changed · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has a restricted project bypass leading to arbitrary command execution
Advisory: https://github.com/advisories/GHSA-48q5-w887-33wv
The commit: https://github.com/github/advisory-database/commit/9843e758d8a6bdf96faba4ba962bdf47011ee643
The file: https://github.com/github/advisory-database/blob/9843e758d8a6bdf96faba4ba962bdf47011ee643/advisories/github-reviewed/2026/06/GHSA-48q5-w887-33wv/GHSA-48q5-w887-33wv.json
GHSA-73hr-m85f-64v9 · changed · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has an arbitrary file write on host via `exec-output` symlink in crafted image
Advisory: https://github.com/advisories/GHSA-73hr-m85f-64v9
The commit: https://github.com/github/advisory-database/commit/fec7032b5bb9f790a16067369a11e480722f4fb9
The file: https://github.com/github/advisory-database/blob/fec7032b5bb9f790a16067369a11e480722f4fb9/advisories/github-reviewed/2026/06/GHSA-73hr-m85f-64v9/GHSA-73hr-m85f-64v9.json
GHSA-wp5r-2gw5-m7q7 · changed · vm2 · MODERATE · vm2's Transformer Fast-Path Bypass Exposes Internal State Variable
Advisory: https://github.com/advisories/GHSA-wp5r-2gw5-m7q7
The commit: https://github.com/github/advisory-database/commit/39caaca4c1b43ae1b1b262f5e83159cbd9e145c3
The file: https://github.com/github/advisory-database/blob/39caaca4c1b43ae1b1b262f5e83159cbd9e145c3/advisories/github-reviewed/2026/05/GHSA-wp5r-2gw5-m7q7/GHSA-wp5r-2gw5-m7q7.json
GHSA-m5w8-4gq2-6f8x · changed · vm2 · CRITICAL · vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
Advisory: https://github.com/advisories/GHSA-m5w8-4gq2-6f8x
The commit: https://github.com/github/advisory-database/commit/e6882087f0d73ac8d9d9fcad3b5371f5e2bbcd4e
The file: https://github.com/github/advisory-database/blob/e6882087f0d73ac8d9d9fcad3b5371f5e2bbcd4e/advisories/github-reviewed/2026/08/GHSA-m5w8-4gq2-6f8x/GHSA-m5w8-4gq2-6f8x.json
GHSA-45rp-9p97-h852 · changed · nocodb · MODERATE · NocoDB Vulnerable to SQL Injection via DATEADD Formula
Advisory: https://github.com/advisories/GHSA-45rp-9p97-h852
The commit: https://github.com/github/advisory-database/commit/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878
The file: https://github.com/github/advisory-database/blob/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878/advisories/github-reviewed/2026/03/GHSA-45rp-9p97-h852/GHSA-45rp-9p97-h852.json
GHSA-mpp2-x7wv-38hv · changed · nocodb · LOW · NocoDB has Plaintext Storage of Shared View Passwords
Advisory: https://github.com/advisories/GHSA-mpp2-x7wv-38hv
The commit: https://github.com/github/advisory-database/commit/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878
The file: https://github.com/github/advisory-database/blob/5d38f3541c89d3b2b9ab0fb91ddcecb30d831878/advisories/github-reviewed/2026/03/GHSA-mpp2-x7wv-38hv/GHSA-mpp2-x7wv-38hv.json
GHSA-p9x3-w98f-7j3q · changed · nocodb · MODERATE · NocoDB Missing Ownership Validation in MCP Token Operations
Advisory: https://github.com/advisories/GHSA-p9x3-w98f-7j3q
The commit: https://github.com/github/advisory-database/commit/2a4c7a05de1c8873ea59d5622dab0076bddc3957
The file: https://github.com/github/advisory-database/blob/2a4c7a05de1c8873ea59d5622dab0076bddc3957/advisories/github-reviewed/2026/03/GHSA-p9x3-w98f-7j3q/GHSA-p9x3-w98f-7j3q.json
GHSA-x4vh-j75g-268g · changed · nocodb · MODERATE · NocoDB's Refresh Tokens Not Revoked on Password Reset
Advisory: https://github.com/advisories/GHSA-x4vh-j75g-268g
The commit: https://github.com/github/advisory-database/commit/bf4213ab9f1b0ac55849e37db406cc43a18b86ff
The file: https://github.com/github/advisory-database/blob/bf4213ab9f1b0ac55849e37db406cc43a18b86ff/advisories/github-reviewed/2026/03/GHSA-x4vh-j75g-268g/GHSA-x4vh-j75g-268g.json
GHSA-7prp-2623-8g45 · changed · djust · HIGH · djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
Advisory: https://github.com/advisories/GHSA-7prp-2623-8g45
The commit: https://github.com/github/advisory-database/commit/fb038a5ae11c8a0f19ea670ea43e0fffde2b53b3
The file: https://github.com/github/advisory-database/blob/fb038a5ae11c8a0f19ea670ea43e0fffde2b53b3/advisories/github-reviewed/2026/09/GHSA-7prp-2623-8g45/GHSA-7prp-2623-8g45.json
GHSA-vxp5-584q-c479 · changed · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has arbitrary file read+write on host via templates/ symlink in malicious image
Advisory: https://github.com/advisories/GHSA-vxp5-584q-c479
The commit: https://github.com/github/advisory-database/commit/4c4cdf40232626b41099bc618e36e4b1a18f2f01
The file: https://github.com/github/advisory-database/blob/4c4cdf40232626b41099bc618e36e4b1a18f2f01/advisories/github-reviewed/2026/06/GHSA-vxp5-584q-c479/GHSA-vxp5-584q-c479.json
GHSA-2q3f-q5pq-g8wv · changed · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
Advisory: https://github.com/advisories/GHSA-2q3f-q5pq-g8wv
The commit: https://github.com/github/advisory-database/commit/4159cc452914e4c6a5796e300c17db0dc9c05736
The file: https://github.com/github/advisory-database/blob/4159cc452914e4c6a5796e300c17db0dc9c05736/advisories/github-reviewed/2026/06/GHSA-2q3f-q5pq-g8wv/GHSA-2q3f-q5pq-g8wv.json
GHSA-v6mj-8pf4-hhw4 · changed · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has an argument injection in backup compression algorithm leading to AFW and ACE
Advisory: https://github.com/advisories/GHSA-v6mj-8pf4-hhw4
The commit: https://github.com/github/advisory-database/commit/4e9366c004761377a2fc3e1a09714405e2156140
The file: https://github.com/github/advisory-database/blob/4e9366c004761377a2fc3e1a09714405e2156140/advisories/github-reviewed/2026/06/GHSA-v6mj-8pf4-hhw4/GHSA-v6mj-8pf4-hhw4.json
GHSA-f6m5-xw2g-xc4x · changed · github[.]com/lxc/incus/v7/cmd/incusd · CRITICAL · Incus has an arbitrary file write on its client due to trusted image hash
Advisory: https://github.com/advisories/GHSA-f6m5-xw2g-xc4x
The commit: https://github.com/github/advisory-database/commit/c1e192becf23c40e09ea6cb0aac29ae7e195170f
The file: https://github.com/github/advisory-database/blob/c1e192becf23c40e09ea6cb0aac29ae7e195170f/advisories/github-reviewed/2026/06/GHSA-f6m5-xw2g-xc4x/GHSA-f6m5-xw2g-xc4x.json
Permanent record: https://flarereef.flareforward.com/n/434