November 6, 2026

November 6, 2026

On November 6, 2026, GitHub's security advisory list published 18 new advisories, changed 6, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.

• GHSA-9qpr-vc49-hqg2
  PyPI · wger · HIGH · wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
  Advisory · The commit · The file
• GHSA-9754-6rhw-gj3h
  PyPI · nbconvert · MODERATE · jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd[.]mermaid` output in HTML exports
  Advisory · The commit · The file
• GHSA-jmqv-2mx7-544h
  NuGet · Magick[.]NET-Q16-AnyCPU · MODERATE · Duplicate Advisory: ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS
  Advisory · The commit · The file
• GHSA-wgxp-q8xq-wpp9
  NuGet · Magick[.]NET-Q16-AnyCPU, Magick[.]NET-Q16-HDRI-AnyCPU, Magick[.]NET-Q16-HDRI-OpenMP-arm64, Magick[.]NET-Q16-HDRI-OpenMP-x64, Magick[.]NET-Q16-HDRI-arm64, Magick[.]NET-Q16-HDRI-x64, Magick[.]NET-Q16-HDRI-x86, Magick[.]NET-Q16-OpenMP-arm64, Magick[.]NET-Q16-OpenMP-x64, Magick[.]NET-Q16-OpenMP-x86, Magick[.]NET-Q16-arm64, Magick[.]NET-Q16-x64, Magick[.]NET-Q16-x86, Magick[.]NET-Q8-AnyCPU, Magick[.]NET-Q8-OpenMP-arm64, Magick[.]NET-Q8-OpenMP-x64, Magick[.]NET-Q8-arm64, Magick[.]NET-Q8-x64, Magick[.]NET-Q8-x86 · MODERATE · ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS
  Advisory · The commit · The file
• GHSA-f3j8-8ggq-f9x2
  Maven · org[.]eclipse[.]hawkbit:hawkbit-ddi-resource · MODERATE · Duplicate Advisory: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration
  Advisory · The commit · The file
• GHSA-92r3-p8c2-3fpx
  Maven · org[.]eclipse[.]hawkbit:hawkbit-ddi-resource · MODERATE · Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration
  Advisory · The commit · The file
• GHSA-5w5g-j6hw-6p8f
  Go · github[.]com/osac-project/osac-operator · HIGH · OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
  Advisory · The commit · The file
• GHSA-xgjr-7j9q-2h4r
  Go · github[.]com/knadh/listmonk · MODERATE · listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
  Advisory · The commit · The file
• GHSA-3gq2-x4qg-p4g6
  Go · github[.]com/canonical/lxd · MODERATE · LXD: SSRF via image import from URL allows internal network probing by authenticated users
  Advisory · The commit · The file
• GHSA-cj9g-27ph-4cgv
  PyPI · wger · HIGH · wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API
  Advisory · The commit · The file
• GHSA-9j25-mm2h-2f76
  Go · github[.]com/canonical/lxd · CRITICAL · LXD has arbitrary file write on host via `exec-output` symlink in crafted image
  Advisory · The commit · The file
• GHSA-jpf8-86f3-wp38
  Go · github[.]com/canonical/lxd · CRITICAL · LXD has arbitrary file read+write on host via templates/ symlink in malicious image
  Advisory · The commit · The file
• GHSA-3x7p-v8hj-xh5m
  Packagist · facturascripts/facturascripts · LOW · FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`
  Advisory · The commit · The file
• GHSA-mxwc-wh95-pw4g
  PyPI · trapster · MODERATE · Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler
  Advisory · The commit · The file
• GHSA-vghh-5rfx-xhq8
  Go · github[.]com/canonical/lxd · CRITICAL · LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
  Advisory · The commit · The file
• GHSA-9fpx-fr6j-2vh6
  PyPI · GeoNode · HIGH · GeoNode has OS command injection via uploaded file layer name
  Advisory · The commit · The file
• GHSA-fmc8-p6q7-75cc
  Go · github[.]com/canonical/lxd · CRITICAL · LXD has argument injection in backup compression algorithm leading to AFW and ACE
  Advisory · The commit · The file
• GHSA-j93m-3j9p-m5m8
  Go · github[.]com/canonical/lxd · MODERATE · LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at
  Advisory · The commit · The file
• GHSA-pjff-c2wc-f6jm
  Go · github[.]com/canonical/lxd · CRITICAL · LXD has arbitrary file write on client due to trusted image hash
  Advisory · The commit · The file
• GHSA-fqpv-mq26-pr4j
  PyPI · GeoNode · MODERATE · GeoNode has Unrestricted File Upload
  Advisory · The commit · The file
• GHSA-r4hm-p9f9-fj9v
  PyPI · GeoNode · MODERATE · GeoNode has Stored XSS in Documents metadata abstract field
  Advisory · The commit · The file
• GHSA-47w9-6r3f-938g
  Go · github[.]com/canonical/lxd · CRITICAL · LXD has restricted project bypass leading to arbitrary command execution
  Advisory · The commit · The file
• GHSA-7mr3-28h5-m5vx
  Go · github[.]com/canonical/lxd · HIGH · LXD has project restriction bypass for custom volume copy across projects
  Advisory · The commit · The file
• GHSA-qx75-2p3r-pwm5
  Go · github[.]com/canonical/lxd · HIGH · LXD has project restriction bypass in instance copy across projects
  Advisory · The commit · The file

Permanent record