Security advisories (GitHub reviewed), as recorded on Flare Reef (https://flarereef.flareforward.com/p/20)

November 6, 2026. On November 6, 2026, GitHub's security advisory list published 18 new advisories, changed 6, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.
GHSA-9qpr-vc49-hqg2 · changed · wger · HIGH · wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
Advisory: https://github.com/advisories/GHSA-9qpr-vc49-hqg2
The commit: https://github.com/github/advisory-database/commit/d8159cf6826589a2eb30a1bc4ee47167dfcdf867
The file: https://github.com/github/advisory-database/blob/d8159cf6826589a2eb30a1bc4ee47167dfcdf867/advisories/github-reviewed/2026/05/GHSA-9qpr-vc49-hqg2/GHSA-9qpr-vc49-hqg2.json
GHSA-9754-6rhw-gj3h · changed · nbconvert · MODERATE · jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd[.]mermaid` output in HTML exports
Advisory: https://github.com/advisories/GHSA-9754-6rhw-gj3h
The commit: https://github.com/github/advisory-database/commit/2abdc2fd6dbf6991dcfef305ca30ff247e33c6ac
The file: https://github.com/github/advisory-database/blob/2abdc2fd6dbf6991dcfef305ca30ff247e33c6ac/advisories/github-reviewed/2026/06/GHSA-9754-6rhw-gj3h/GHSA-9754-6rhw-gj3h.json
GHSA-jmqv-2mx7-544h · published · Magick[.]NET-Q16-AnyCPU · MODERATE · Duplicate Advisory: ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS
Advisory: https://github.com/advisories/GHSA-jmqv-2mx7-544h
The commit: https://github.com/github/advisory-database/commit/7303a461f21dd7385ee649343a982dcee1b23bfc
The file: https://github.com/github/advisory-database/blob/7303a461f21dd7385ee649343a982dcee1b23bfc/advisories/github-reviewed/2026/06/GHSA-jmqv-2mx7-544h/GHSA-jmqv-2mx7-544h.json
GHSA-wgxp-q8xq-wpp9 · changed · Magick[.]NET-Q16-AnyCPU · Magick[.]NET-Q16-HDRI-AnyCPU · Magick[.]NET-Q16-HDRI-OpenMP-arm64 · Magick[.]NET-Q16-HDRI-OpenMP-x64 · Magick[.]NET-Q16-HDRI-arm64 · Magick[.]NET-Q16-HDRI-x64 · Magick[.]NET-Q16-HDRI-x86 · Magick[.]NET-Q16-OpenMP-arm64 · Magick[.]NET-Q16-OpenMP-x64 · Magick[.]NET-Q16-OpenMP-x86 · Magick[.]NET-Q16-arm64 · Magick[.]NET-Q16-x64 · Magick[.]NET-Q16-x86 · Magick[.]NET-Q8-AnyCPU · Magick[.]NET-Q8-OpenMP-arm64 · Magick[.]NET-Q8-OpenMP-x64 · Magick[.]NET-Q8-arm64 · Magick[.]NET-Q8-x64 · Magick[.]NET-Q8-x86 · MODERATE · ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS 
Advisory: https://github.com/advisories/GHSA-wgxp-q8xq-wpp9
The commit: https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c
The file: https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/02/GHSA-wgxp-q8xq-wpp9/GHSA-wgxp-q8xq-wpp9.json
GHSA-f3j8-8ggq-f9x2 · published · org[.]eclipse[.]hawkbit:hawkbit-ddi-resource · MODERATE · Duplicate Advisory: Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration
Advisory: https://github.com/advisories/GHSA-f3j8-8ggq-f9x2
The commit: https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c
The file: https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/07/GHSA-f3j8-8ggq-f9x2/GHSA-f3j8-8ggq-f9x2.json
GHSA-92r3-p8c2-3fpx · published · org[.]eclipse[.]hawkbit:hawkbit-ddi-resource · MODERATE · Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration
Advisory: https://github.com/advisories/GHSA-92r3-p8c2-3fpx
The commit: https://github.com/github/advisory-database/commit/ed704a5cd60ba35a2429a409d3be07d36f41e08c
The file: https://github.com/github/advisory-database/blob/ed704a5cd60ba35a2429a409d3be07d36f41e08c/advisories/github-reviewed/2026/11/GHSA-92r3-p8c2-3fpx/GHSA-92r3-p8c2-3fpx.json
GHSA-5w5g-j6hw-6p8f · published · github[.]com/osac-project/osac-operator · HIGH · OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
Advisory: https://github.com/advisories/GHSA-5w5g-j6hw-6p8f
The commit: https://github.com/github/advisory-database/commit/10513dddf0f482af42e8261be7ea71baca7d063e
The file: https://github.com/github/advisory-database/blob/10513dddf0f482af42e8261be7ea71baca7d063e/advisories/github-reviewed/2026/11/GHSA-5w5g-j6hw-6p8f/GHSA-5w5g-j6hw-6p8f.json
GHSA-xgjr-7j9q-2h4r · published · github[.]com/knadh/listmonk · MODERATE · listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
Advisory: https://github.com/advisories/GHSA-xgjr-7j9q-2h4r
The commit: https://github.com/github/advisory-database/commit/505c16faeefc2c60dac1977526f063b4bf3dbaeb
The file: https://github.com/github/advisory-database/blob/505c16faeefc2c60dac1977526f063b4bf3dbaeb/advisories/github-reviewed/2026/11/GHSA-xgjr-7j9q-2h4r/GHSA-xgjr-7j9q-2h4r.json
GHSA-3gq2-x4qg-p4g6 · published · github[.]com/canonical/lxd · MODERATE · LXD: SSRF via image import from URL allows internal network probing by authenticated users
Advisory: https://github.com/advisories/GHSA-3gq2-x4qg-p4g6
The commit: https://github.com/github/advisory-database/commit/fcf0b93e2b616ad34bf93aa7785158a441b55ed2
The file: https://github.com/github/advisory-database/blob/fcf0b93e2b616ad34bf93aa7785158a441b55ed2/advisories/github-reviewed/2026/11/GHSA-3gq2-x4qg-p4g6/GHSA-3gq2-x4qg-p4g6.json
GHSA-cj9g-27ph-4cgv · changed · wger · HIGH · wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API
Advisory: https://github.com/advisories/GHSA-cj9g-27ph-4cgv
The commit: https://github.com/github/advisory-database/commit/1e11a8ef60c6edc18d40815f315106ebfda2ce00
The file: https://github.com/github/advisory-database/blob/1e11a8ef60c6edc18d40815f315106ebfda2ce00/advisories/github-reviewed/2026/05/GHSA-cj9g-27ph-4cgv/GHSA-cj9g-27ph-4cgv.json
GHSA-9j25-mm2h-2f76 · published · github[.]com/canonical/lxd · CRITICAL · LXD has arbitrary file write on host via `exec-output` symlink in crafted image
Advisory: https://github.com/advisories/GHSA-9j25-mm2h-2f76
The commit: https://github.com/github/advisory-database/commit/5194356220262508faf3af7209007a06f7fe8f31
The file: https://github.com/github/advisory-database/blob/5194356220262508faf3af7209007a06f7fe8f31/advisories/github-reviewed/2026/11/GHSA-9j25-mm2h-2f76/GHSA-9j25-mm2h-2f76.json
GHSA-jpf8-86f3-wp38 · published · github[.]com/canonical/lxd · CRITICAL · LXD has arbitrary file read+write on host via templates/ symlink in malicious image
Advisory: https://github.com/advisories/GHSA-jpf8-86f3-wp38
The commit: https://github.com/github/advisory-database/commit/96f7f41801a86538b75b4bcc9eff62b1a76f6e1d
The file: https://github.com/github/advisory-database/blob/96f7f41801a86538b75b4bcc9eff62b1a76f6e1d/advisories/github-reviewed/2026/11/GHSA-jpf8-86f3-wp38/GHSA-jpf8-86f3-wp38.json
GHSA-3x7p-v8hj-xh5m · changed · facturascripts/facturascripts · LOW · FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`
Advisory: https://github.com/advisories/GHSA-3x7p-v8hj-xh5m
The commit: https://github.com/github/advisory-database/commit/9e79cd0d159720bd1dd99f7fde08642e2908f30f
The file: https://github.com/github/advisory-database/blob/9e79cd0d159720bd1dd99f7fde08642e2908f30f/advisories/github-reviewed/2026/07/GHSA-3x7p-v8hj-xh5m/GHSA-3x7p-v8hj-xh5m.json
GHSA-mxwc-wh95-pw4g · changed · trapster · MODERATE · Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler
Advisory: https://github.com/advisories/GHSA-mxwc-wh95-pw4g
The commit: https://github.com/github/advisory-database/commit/c6718f419947064fe70016c160d434677457d6d1
The file: https://github.com/github/advisory-database/blob/c6718f419947064fe70016c160d434677457d6d1/advisories/github-reviewed/2026/07/GHSA-mxwc-wh95-pw4g/GHSA-mxwc-wh95-pw4g.json
GHSA-vghh-5rfx-xhq8 · published · github[.]com/canonical/lxd · CRITICAL · LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
Advisory: https://github.com/advisories/GHSA-vghh-5rfx-xhq8
The commit: https://github.com/github/advisory-database/commit/2957c4b6dbe5add45829f6ac802e9fb32a71920d
The file: https://github.com/github/advisory-database/blob/2957c4b6dbe5add45829f6ac802e9fb32a71920d/advisories/github-reviewed/2026/11/GHSA-vghh-5rfx-xhq8/GHSA-vghh-5rfx-xhq8.json
GHSA-9fpx-fr6j-2vh6 · published · GeoNode · HIGH · GeoNode has OS command injection via uploaded file layer name
Advisory: https://github.com/advisories/GHSA-9fpx-fr6j-2vh6
The commit: https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4
The file: https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-9fpx-fr6j-2vh6/GHSA-9fpx-fr6j-2vh6.json
GHSA-fmc8-p6q7-75cc · published · github[.]com/canonical/lxd · CRITICAL · LXD has argument injection in backup compression algorithm leading to AFW and ACE
Advisory: https://github.com/advisories/GHSA-fmc8-p6q7-75cc
The commit: https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4
The file: https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-fmc8-p6q7-75cc/GHSA-fmc8-p6q7-75cc.json
GHSA-j93m-3j9p-m5m8 · published · github[.]com/canonical/lxd · MODERATE · LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at
Advisory: https://github.com/advisories/GHSA-j93m-3j9p-m5m8
The commit: https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4
The file: https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-j93m-3j9p-m5m8/GHSA-j93m-3j9p-m5m8.json
GHSA-pjff-c2wc-f6jm · published · github[.]com/canonical/lxd · CRITICAL · LXD has arbitrary file write on client due to trusted image hash
Advisory: https://github.com/advisories/GHSA-pjff-c2wc-f6jm
The commit: https://github.com/github/advisory-database/commit/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4
The file: https://github.com/github/advisory-database/blob/4c7a5221cb2f673db6b3473c8d4c34fbb5c9e7f4/advisories/github-reviewed/2026/11/GHSA-pjff-c2wc-f6jm/GHSA-pjff-c2wc-f6jm.json
GHSA-fqpv-mq26-pr4j · published · GeoNode · MODERATE · GeoNode has Unrestricted File Upload
Advisory: https://github.com/advisories/GHSA-fqpv-mq26-pr4j
The commit: https://github.com/github/advisory-database/commit/53f590f0eb6b365dd5bf54f8a077b1e0352e8252
The file: https://github.com/github/advisory-database/blob/53f590f0eb6b365dd5bf54f8a077b1e0352e8252/advisories/github-reviewed/2026/11/GHSA-fqpv-mq26-pr4j/GHSA-fqpv-mq26-pr4j.json
GHSA-r4hm-p9f9-fj9v · published · GeoNode · MODERATE · GeoNode has Stored XSS in Documents metadata abstract field
Advisory: https://github.com/advisories/GHSA-r4hm-p9f9-fj9v
The commit: https://github.com/github/advisory-database/commit/0d413bb2a07b6216969b5a0ab87b2b6bc37eee83
The file: https://github.com/github/advisory-database/blob/0d413bb2a07b6216969b5a0ab87b2b6bc37eee83/advisories/github-reviewed/2026/11/GHSA-r4hm-p9f9-fj9v/GHSA-r4hm-p9f9-fj9v.json
GHSA-47w9-6r3f-938g · published · github[.]com/canonical/lxd · CRITICAL · LXD has restricted project bypass leading to arbitrary command execution
Advisory: https://github.com/advisories/GHSA-47w9-6r3f-938g
The commit: https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858
The file: https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-47w9-6r3f-938g/GHSA-47w9-6r3f-938g.json
GHSA-7mr3-28h5-m5vx · published · github[.]com/canonical/lxd · HIGH · LXD has project restriction bypass for custom volume copy across projects 
Advisory: https://github.com/advisories/GHSA-7mr3-28h5-m5vx
The commit: https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858
The file: https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-7mr3-28h5-m5vx/GHSA-7mr3-28h5-m5vx.json
GHSA-qx75-2p3r-pwm5 · published · github[.]com/canonical/lxd · HIGH · LXD has project restriction bypass in instance copy across projects 
Advisory: https://github.com/advisories/GHSA-qx75-2p3r-pwm5
The commit: https://github.com/github/advisory-database/commit/5ca63d9b5b4796275f29e5da5e72c5959f919858
The file: https://github.com/github/advisory-database/blob/5ca63d9b5b4796275f29e5da5e72c5959f919858/advisories/github-reviewed/2026/11/GHSA-qx75-2p3r-pwm5/GHSA-qx75-2p3r-pwm5.json
Permanent record: https://flarereef.flareforward.com/n/439