Security advisories (GitHub reviewed), as recorded on Flare Reef (https://flarereef.flareforward.com/p/20)

November 9, 2026. On November 9, 2026, GitHub's security advisory list published 45 new advisories, changed 23, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.
GHSA-rfx3-98h7-v3xp · changed · Marten · CRITICAL · Marten's LINQ provider has SQL injection via unescaped string literals
Advisory: https://github.com/advisories/GHSA-rfx3-98h7-v3xp
The commit: https://github.com/github/advisory-database/commit/fec901422fe97937357912b981bd684ceb90ed90
The file: https://github.com/github/advisory-database/blob/fec901422fe97937357912b981bd684ceb90ed90/advisories/github-reviewed/2026/09/GHSA-rfx3-98h7-v3xp/GHSA-rfx3-98h7-v3xp.json
GHSA-8fxw-fmj8-xp7j · changed · mongodb/mongodb · MODERATE · MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
Advisory: https://github.com/advisories/GHSA-8fxw-fmj8-xp7j
The commit: https://github.com/github/advisory-database/commit/ee60ae9a10bde8d40f03690f90e8e05ae96b4cc7
The file: https://github.com/github/advisory-database/blob/ee60ae9a10bde8d40f03690f90e8e05ae96b4cc7/advisories/github-reviewed/2026/10/GHSA-8fxw-fmj8-xp7j/GHSA-8fxw-fmj8-xp7j.json
GHSA-w7qv-268h-9h3f · published · loggingredactor · HIGH · Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
Advisory: https://github.com/advisories/GHSA-w7qv-268h-9h3f
The commit: https://github.com/github/advisory-database/commit/187275eb1a5f35244190c0102764fde701eca3e9
The file: https://github.com/github/advisory-database/blob/187275eb1a5f35244190c0102764fde701eca3e9/advisories/github-reviewed/2026/11/GHSA-w7qv-268h-9h3f/GHSA-w7qv-268h-9h3f.json
GHSA-52c6-99qm-3hqr · published · org[.]zeroturnaround:zt-zip · HIGH · zt-zip: Path traversal in fluent API unpack
Advisory: https://github.com/advisories/GHSA-52c6-99qm-3hqr
The commit: https://github.com/github/advisory-database/commit/a7fb05fbd5da52032db351e072f8da48488ad30c
The file: https://github.com/github/advisory-database/blob/a7fb05fbd5da52032db351e072f8da48488ad30c/advisories/github-reviewed/2026/11/GHSA-52c6-99qm-3hqr/GHSA-52c6-99qm-3hqr.json
GHSA-h667-4jj2-cgv4 · published · fastapi-code-generator · CRITICAL · fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
Advisory: https://github.com/advisories/GHSA-h667-4jj2-cgv4
The commit: https://github.com/github/advisory-database/commit/bc1817f9e59d4d1c85b11fc97dd5c357de13aaa7
The file: https://github.com/github/advisory-database/blob/bc1817f9e59d4d1c85b11fc97dd5c357de13aaa7/advisories/github-reviewed/2026/11/GHSA-h667-4jj2-cgv4/GHSA-h667-4jj2-cgv4.json
GHSA-6xmv-cjr5-w3q8 · published · fastapi-code-generator · CRITICAL · fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app[.]get(..., responses={...}) dict
Advisory: https://github.com/advisories/GHSA-6xmv-cjr5-w3q8
The commit: https://github.com/github/advisory-database/commit/d67dc8470512c823300addf219feafd74338ed5b
The file: https://github.com/github/advisory-database/blob/d67dc8470512c823300addf219feafd74338ed5b/advisories/github-reviewed/2026/11/GHSA-6xmv-cjr5-w3q8/GHSA-6xmv-cjr5-w3q8.json
GHSA-p2mm-64f6-gmpp · published · fastapi-code-generator · CRITICAL · fastapi-code-generator: Import-time RCE via route path -> unescaped @app[.]get('...') decorator
Advisory: https://github.com/advisories/GHSA-p2mm-64f6-gmpp
The commit: https://github.com/github/advisory-database/commit/d8fce65f49add7b6da1940cb7274d618be330da0
The file: https://github.com/github/advisory-database/blob/d8fce65f49add7b6da1940cb7274d618be330da0/advisories/github-reviewed/2026/11/GHSA-p2mm-64f6-gmpp/GHSA-p2mm-64f6-gmpp.json
GHSA-9qw7-j9xw-fv9c · published · isomorphic-git · HIGH · isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE)
Advisory: https://github.com/advisories/GHSA-9qw7-j9xw-fv9c
The commit: https://github.com/github/advisory-database/commit/b18aaf9b65e2f55252957c08dfe5bba2bda70557
The file: https://github.com/github/advisory-database/blob/b18aaf9b65e2f55252957c08dfe5bba2bda70557/advisories/github-reviewed/2026/11/GHSA-9qw7-j9xw-fv9c/GHSA-9qw7-j9xw-fv9c.json
GHSA-jwjp-4649-v8jp · changed · SIPSorcery · HIGH · SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing
Advisory: https://github.com/advisories/GHSA-jwjp-4649-v8jp
The commit: https://github.com/github/advisory-database/commit/1c4bca1757976e10298e422db396e1982531ebdf
The file: https://github.com/github/advisory-database/blob/1c4bca1757976e10298e422db396e1982531ebdf/advisories/github-reviewed/2026/08/GHSA-jwjp-4649-v8jp/GHSA-jwjp-4649-v8jp.json
GHSA-96wc-2m84-2cj7 · published · isomorphic-git · MODERATE · isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)
Advisory: https://github.com/advisories/GHSA-96wc-2m84-2cj7
The commit: https://github.com/github/advisory-database/commit/4638fd6c99a1a8129739415b40661d33cd1f762b
The file: https://github.com/github/advisory-database/blob/4638fd6c99a1a8129739415b40661d33cd1f762b/advisories/github-reviewed/2026/11/GHSA-96wc-2m84-2cj7/GHSA-96wc-2m84-2cj7.json
GHSA-cw2g-2vwq-88w6 · published · isomorphic-git · MODERATE · isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout
Advisory: https://github.com/advisories/GHSA-cw2g-2vwq-88w6
The commit: https://github.com/github/advisory-database/commit/0f109e5ef0d3bf352aa03e494d13edd84920ecc7
The file: https://github.com/github/advisory-database/blob/0f109e5ef0d3bf352aa03e494d13edd84920ecc7/advisories/github-reviewed/2026/11/GHSA-cw2g-2vwq-88w6/GHSA-cw2g-2vwq-88w6.json
GHSA-qp9x-wp8f-qgjj · changed · tuf · MODERATE · tuf has platform-dependent delegation path matching
Advisory: https://github.com/advisories/GHSA-qp9x-wp8f-qgjj
The commit: https://github.com/github/advisory-database/commit/f10b20320c074faa1adba992e7cc44b62eb6f12b
The file: https://github.com/github/advisory-database/blob/f10b20320c074faa1adba992e7cc44b62eb6f12b/advisories/github-reviewed/2026/05/GHSA-qp9x-wp8f-qgjj/GHSA-qp9x-wp8f-qgjj.json
GHSA-4xm8-rg9h-jhq2 · changed · signalk-server · @signalk/resources-provider · CRITICAL · Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution
Advisory: https://github.com/advisories/GHSA-4xm8-rg9h-jhq2
The commit: https://github.com/github/advisory-database/commit/cfd604cb0ab6b56e205fad72b7f7d5b04583869f
The file: https://github.com/github/advisory-database/blob/cfd604cb0ab6b56e205fad72b7f7d5b04583869f/advisories/github-reviewed/2026/10/GHSA-4xm8-rg9h-jhq2/GHSA-4xm8-rg9h-jhq2.json
GHSA-p74g-f95m-7fx7 · published · github[.]com/traPtitech/traQ · HIGH · traQ: XSS in the User Uploaded File Retrieval API
Advisory: https://github.com/advisories/GHSA-p74g-f95m-7fx7
The commit: https://github.com/github/advisory-database/commit/03ce40e4060df762d53ee2f994002a8c0f096e17
The file: https://github.com/github/advisory-database/blob/03ce40e4060df762d53ee2f994002a8c0f096e17/advisories/github-reviewed/2026/11/GHSA-p74g-f95m-7fx7/GHSA-p74g-f95m-7fx7.json
GHSA-xrmj-5g4g-8987 · changed · @dynatrace-oss/dynatrace-mcp-server · MODERATE · @dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification
Advisory: https://github.com/advisories/GHSA-xrmj-5g4g-8987
The commit: https://github.com/github/advisory-database/commit/517b1dfd255d57ee85dda6bde92abdad0ba31dc1
The file: https://github.com/github/advisory-database/blob/517b1dfd255d57ee85dda6bde92abdad0ba31dc1/advisories/github-reviewed/2026/07/GHSA-xrmj-5g4g-8987/GHSA-xrmj-5g4g-8987.json
GHSA-8cfq-jgf7-8m27 · published · github[.]com/traPtitech/traQ · HIGH · traQ: Privilege escalation by OAuth prompt=none request
Advisory: https://github.com/advisories/GHSA-8cfq-jgf7-8m27
The commit: https://github.com/github/advisory-database/commit/517b1dfd255d57ee85dda6bde92abdad0ba31dc1
The file: https://github.com/github/advisory-database/blob/517b1dfd255d57ee85dda6bde92abdad0ba31dc1/advisories/github-reviewed/2026/11/GHSA-8cfq-jgf7-8m27/GHSA-8cfq-jgf7-8m27.json
GHSA-pqh8-p93p-2rx7 · changed · @dynatrace-oss/dynatrace-mcp-server · MODERATE · @dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL
Advisory: https://github.com/advisories/GHSA-pqh8-p93p-2rx7
The commit: https://github.com/github/advisory-database/commit/5520d19b6b821e6c9bf2bd2315ee532fab225fe3
The file: https://github.com/github/advisory-database/blob/5520d19b6b821e6c9bf2bd2315ee532fab225fe3/advisories/github-reviewed/2026/07/GHSA-pqh8-p93p-2rx7/GHSA-pqh8-p93p-2rx7.json
GHSA-p7w7-4929-vpj5 · changed · @dynatrace-oss/dynatrace-mcp-server · HIGH · `@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation
Advisory: https://github.com/advisories/GHSA-p7w7-4929-vpj5
The commit: https://github.com/github/advisory-database/commit/b6f283b1b6f012d834ca100a3464fc0ec6cd71e8
The file: https://github.com/github/advisory-database/blob/b6f283b1b6f012d834ca100a3464fc0ec6cd71e8/advisories/github-reviewed/2026/07/GHSA-p7w7-4929-vpj5/GHSA-p7w7-4929-vpj5.json
GHSA-v2g6-7r9j-v6px · published · org[.]zeroturnaround:zt-zip · MODERATE · zt-zip: ZipUtil[.]unpack can change file permissions of output directory
Advisory: https://github.com/advisories/GHSA-v2g6-7r9j-v6px
The commit: https://github.com/github/advisory-database/commit/3d4058fecd81d20aaf6b63564c77bd766c6ce556
The file: https://github.com/github/advisory-database/blob/3d4058fecd81d20aaf6b63564c77bd766c6ce556/advisories/github-reviewed/2026/11/GHSA-v2g6-7r9j-v6px/GHSA-v2g6-7r9j-v6px.json
GHSA-jq7h-wrvp-3rgx · changed · pyload-ng · HIGH · pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
Advisory: https://github.com/advisories/GHSA-jq7h-wrvp-3rgx
The commit: https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d
The file: https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/10/GHSA-jq7h-wrvp-3rgx/GHSA-jq7h-wrvp-3rgx.json
GHSA-p3pr-8f3m-4qp8 · changed · pyload-ng · MODERATE · pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http[.]client notification host
Advisory: https://github.com/advisories/GHSA-p3pr-8f3m-4qp8
The commit: https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d
The file: https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/10/GHSA-p3pr-8f3m-4qp8/GHSA-p3pr-8f3m-4qp8.json
GHSA-6w3r-6hpr-hp6p · published · ag-psd · HIGH · ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)
Advisory: https://github.com/advisories/GHSA-6w3r-6hpr-hp6p
The commit: https://github.com/github/advisory-database/commit/09fc4bd46a85db28c2d520db2b075eb57a802c3d
The file: https://github.com/github/advisory-database/blob/09fc4bd46a85db28c2d520db2b075eb57a802c3d/advisories/github-reviewed/2026/11/GHSA-6w3r-6hpr-hp6p/GHSA-6w3r-6hpr-hp6p.json
GHSA-fr26-jjhm-638c · changed · pyload-ng · HIGH · pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
Advisory: https://github.com/advisories/GHSA-fr26-jjhm-638c
The commit: https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba
The file: https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/10/GHSA-fr26-jjhm-638c/GHSA-fr26-jjhm-638c.json
GHSA-447x-qqwf-m7xq · published · @tsparticles/mcp-server · HIGH · tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
Advisory: https://github.com/advisories/GHSA-447x-qqwf-m7xq
The commit: https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba
The file: https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/11/GHSA-447x-qqwf-m7xq/GHSA-447x-qqwf-m7xq.json
GHSA-ghc9-756g-vrcv · published · org[.]json:json · MODERATE · JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS
Advisory: https://github.com/advisories/GHSA-ghc9-756g-vrcv
The commit: https://github.com/github/advisory-database/commit/52ee78f58cbe932ebead3e5460c733922deabdba
The file: https://github.com/github/advisory-database/blob/52ee78f58cbe932ebead3e5460c733922deabdba/advisories/github-reviewed/2026/11/GHSA-ghc9-756g-vrcv/GHSA-ghc9-756g-vrcv.json
GHSA-r44w-v6gf-x3p6 · changed · pyload-ng · HIGH · pyLoad has an authentication bypass in API key validation (check_apikey cache)
Advisory: https://github.com/advisories/GHSA-r44w-v6gf-x3p6
The commit: https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5
The file: https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/10/GHSA-r44w-v6gf-x3p6/GHSA-r44w-v6gf-x3p6.json
GHSA-4p8p-pjpq-2w7h · published · @tsparticles/mcp-server · HIGH · tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
Advisory: https://github.com/advisories/GHSA-4p8p-pjpq-2w7h
The commit: https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5
The file: https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/11/GHSA-4p8p-pjpq-2w7h/GHSA-4p8p-pjpq-2w7h.json
GHSA-h7c4-q426-7jh9 · published · @tsparticles/mcp-server · MODERATE · tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
Advisory: https://github.com/advisories/GHSA-h7c4-q426-7jh9
The commit: https://github.com/github/advisory-database/commit/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5
The file: https://github.com/github/advisory-database/blob/b5aba64ab99cc44d3c900ad6b8b2b9a6d40213d5/advisories/github-reviewed/2026/11/GHSA-h7c4-q426-7jh9/GHSA-h7c4-q426-7jh9.json
GHSA-39wr-7q6h-cf68 · changed · lmdeploy · HIGH · LMDeploy has an SSRF bypass
Advisory: https://github.com/advisories/GHSA-39wr-7q6h-cf68
The commit: https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a
The file: https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/09/GHSA-39wr-7q6h-cf68/GHSA-39wr-7q6h-cf68.json
GHSA-2g87-pp6c-29x5 · changed · aiohttp · HIGH · aiohttp: Multiple instances of excessive or unbounded memory/CPU use
Advisory: https://github.com/advisories/GHSA-2g87-pp6c-29x5
The commit: https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a
The file: https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/10/GHSA-2g87-pp6c-29x5/GHSA-2g87-pp6c-29x5.json
GHSA-56x6-q882-mf27 · published · github[.]com/umputun/remark42/backend · github[.]com/umputun/remark42 · MODERATE · Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment
Advisory: https://github.com/advisories/GHSA-56x6-q882-mf27
The commit: https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a
The file: https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/11/GHSA-56x6-q882-mf27/GHSA-56x6-q882-mf27.json
GHSA-q4xm-p75h-h9p3 · published · github[.]com/pocket-id/pocket-id/backend · HIGH · Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Advisory: https://github.com/advisories/GHSA-q4xm-p75h-h9p3
The commit: https://github.com/github/advisory-database/commit/c2a6779636bc9f05c97db834b2078402b315e96a
The file: https://github.com/github/advisory-database/blob/c2a6779636bc9f05c97db834b2078402b315e96a/advisories/github-reviewed/2026/11/GHSA-q4xm-p75h-h9p3/GHSA-q4xm-p75h-h9p3.json
GHSA-92hv-j533-69wc · changed · wagtail · LOW · Wagtail: Identification of documents by SHA1 hash
Advisory: https://github.com/advisories/GHSA-92hv-j533-69wc
The commit: https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7
The file: https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-92hv-j533-69wc/GHSA-92hv-j533-69wc.json
GHSA-jm5p-837g-rv8g · changed · wagtail · MODERATE · Wagtail: Improper restriction handling on Page translation API endpoint
Advisory: https://github.com/advisories/GHSA-jm5p-837g-rv8g
The commit: https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7
The file: https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-jm5p-837g-rv8g/GHSA-jm5p-837g-rv8g.json
GHSA-x5cx-w6p2-mxf2 · changed · wagtail · MODERATE · Wagtail: Improper permission handling when copying snippets
Advisory: https://github.com/advisories/GHSA-x5cx-w6p2-mxf2
The commit: https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7
The file: https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/08/GHSA-x5cx-w6p2-mxf2/GHSA-x5cx-w6p2-mxf2.json
GHSA-vvr2-h2jp-838m · published · code-graph-rag · HIGH · Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read
Advisory: https://github.com/advisories/GHSA-vvr2-h2jp-838m
The commit: https://github.com/github/advisory-database/commit/245d12301e56db880b5f2abcfdde3961e2bba1e7
The file: https://github.com/github/advisory-database/blob/245d12301e56db880b5f2abcfdde3961e2bba1e7/advisories/github-reviewed/2026/11/GHSA-vvr2-h2jp-838m/GHSA-vvr2-h2jp-838m.json
GHSA-fhp4-pr5j-46m5 · changed · muhammara · HIGH · Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key
Advisory: https://github.com/advisories/GHSA-fhp4-pr5j-46m5
The commit: https://github.com/github/advisory-database/commit/81569964abbda58f1f1d15a2dcbd97e7b0834cb6
The file: https://github.com/github/advisory-database/blob/81569964abbda58f1f1d15a2dcbd97e7b0834cb6/advisories/github-reviewed/2026/06/GHSA-fhp4-pr5j-46m5/GHSA-fhp4-pr5j-46m5.json
GHSA-rrh3-cwwj-g5mg · changed · cornac · HIGH · Cornac: Path Traversal via _extract_archive() in download[.]py
Advisory: https://github.com/advisories/GHSA-rrh3-cwwj-g5mg
The commit: https://github.com/github/advisory-database/commit/f953a301e2218bac05e58fd9b70f8a2f3b903eb8
The file: https://github.com/github/advisory-database/blob/f953a301e2218bac05e58fd9b70f8a2f3b903eb8/advisories/github-reviewed/2026/07/GHSA-rrh3-cwwj-g5mg/GHSA-rrh3-cwwj-g5mg.json
GHSA-m27g-v28p-f9fx · published · omniauth · MODERATE · OmniAuth: Host Header Injection Vulnerability
Advisory: https://github.com/advisories/GHSA-m27g-v28p-f9fx
The commit: https://github.com/github/advisory-database/commit/c8192f690a9aae85b462b4fde4315042d4e03a32
The file: https://github.com/github/advisory-database/blob/c8192f690a9aae85b462b4fde4315042d4e03a32/advisories/github-reviewed/2026/11/GHSA-m27g-v28p-f9fx/GHSA-m27g-v28p-f9fx.json
GHSA-rr8v-fxxf-c986 · published · com[.]gradleup[.]shadow:com[.]gradleup[.]shadow[.]gradle[.]plugin · HIGH · Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
Advisory: https://github.com/advisories/GHSA-rr8v-fxxf-c986
The commit: https://github.com/github/advisory-database/commit/c8192f690a9aae85b462b4fde4315042d4e03a32
The file: https://github.com/github/advisory-database/blob/c8192f690a9aae85b462b4fde4315042d4e03a32/advisories/github-reviewed/2026/11/GHSA-rr8v-fxxf-c986/GHSA-rr8v-fxxf-c986.json
GHSA-wchh-mrv2-5h4q · published · github[.]com/mayswind/ezbookkeeping · MODERATE · ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header
Advisory: https://github.com/advisories/GHSA-wchh-mrv2-5h4q
The commit: https://github.com/github/advisory-database/commit/111b791fd306825d640b789c94e7ac4ee74f09d9
The file: https://github.com/github/advisory-database/blob/111b791fd306825d640b789c94e7ac4ee74f09d9/advisories/github-reviewed/2026/11/GHSA-wchh-mrv2-5h4q/GHSA-wchh-mrv2-5h4q.json
GHSA-f42p-wjw5-97qh · published · zizmor · HIGH · zizmor: Debug logging prints available GitHub credentials in cleartext
Advisory: https://github.com/advisories/GHSA-f42p-wjw5-97qh
The commit: https://github.com/github/advisory-database/commit/ab28e9fdeefc6dbd6985d8ace1bd9b62eb4c8c7d
The file: https://github.com/github/advisory-database/blob/ab28e9fdeefc6dbd6985d8ace1bd9b62eb4c8c7d/advisories/github-reviewed/2026/11/GHSA-f42p-wjw5-97qh/GHSA-f42p-wjw5-97qh.json
GHSA-6j3h-rp73-6rvf · published · github[.]com/telepresenceio/telepresence/v2 · HIGH · Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable
Advisory: https://github.com/advisories/GHSA-6j3h-rp73-6rvf
The commit: https://github.com/github/advisory-database/commit/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3
The file: https://github.com/github/advisory-database/blob/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3/advisories/github-reviewed/2026/11/GHSA-6j3h-rp73-6rvf/GHSA-6j3h-rp73-6rvf.json
GHSA-j8j4-rw65-56r6 · published · github[.]com/telepresenceio/telepresence · HIGH · Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets
Advisory: https://github.com/advisories/GHSA-j8j4-rw65-56r6
The commit: https://github.com/github/advisory-database/commit/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3
The file: https://github.com/github/advisory-database/blob/7fa2c851919e46d9cab7631c0f0239dc63c2a7a3/advisories/github-reviewed/2026/11/GHSA-j8j4-rw65-56r6/GHSA-j8j4-rw65-56r6.json
GHSA-9vhv-g5hf-m7m7 · published · fast-agent-mcp · MODERATE · fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution
Advisory: https://github.com/advisories/GHSA-9vhv-g5hf-m7m7
The commit: https://github.com/github/advisory-database/commit/654347603de3b8fe2c8c5a49b41c8243f532bfef
The file: https://github.com/github/advisory-database/blob/654347603de3b8fe2c8c5a49b41c8243f532bfef/advisories/github-reviewed/2026/11/GHSA-9vhv-g5hf-m7m7/GHSA-9vhv-g5hf-m7m7.json
GHSA-g3c2-rjq2-c763 · published · github[.]com/esm-dev/esm[.]sh/web · HIGH · esm[.]sh: web[.]NewHandler allows arbitrary file read via encoded dot-segment path traversal
Advisory: https://github.com/advisories/GHSA-g3c2-rjq2-c763
The commit: https://github.com/github/advisory-database/commit/654347603de3b8fe2c8c5a49b41c8243f532bfef
The file: https://github.com/github/advisory-database/blob/654347603de3b8fe2c8c5a49b41c8243f532bfef/advisories/github-reviewed/2026/11/GHSA-g3c2-rjq2-c763/GHSA-g3c2-rjq2-c763.json
GHSA-cp25-j9x5-p5xm · published · urwid · MODERATE · Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)
Advisory: https://github.com/advisories/GHSA-cp25-j9x5-p5xm
The commit: https://github.com/github/advisory-database/commit/f2ea90cf42894cc778a695995921b7824e6b37c9
The file: https://github.com/github/advisory-database/blob/f2ea90cf42894cc778a695995921b7824e6b37c9/advisories/github-reviewed/2026/11/GHSA-cp25-j9x5-p5xm/GHSA-cp25-j9x5-p5xm.json
GHSA-xjw9-38cr-6372 · changed · djust · HIGH · djust: A template binding inherits a context safety grant it never earned (XSS)
Advisory: https://github.com/advisories/GHSA-xjw9-38cr-6372
The commit: https://github.com/github/advisory-database/commit/adcc6836465885f35df6365de66c1b8ebb7bd8dd
The file: https://github.com/github/advisory-database/blob/adcc6836465885f35df6365de66c1b8ebb7bd8dd/advisories/github-reviewed/2026/09/GHSA-xjw9-38cr-6372/GHSA-xjw9-38cr-6372.json
GHSA-vj8v-p5vw-m6v5 · changed · xrootd · MODERATE · xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern
Advisory: https://github.com/advisories/GHSA-vj8v-p5vw-m6v5
The commit: https://github.com/github/advisory-database/commit/403f74092fc8c07ed25c9eebd116dbcccce3ca39
The file: https://github.com/github/advisory-database/blob/403f74092fc8c07ed25c9eebd116dbcccce3ca39/advisories/github-reviewed/2026/04/GHSA-vj8v-p5vw-m6v5/GHSA-vj8v-p5vw-m6v5.json
GHSA-rm8c-2cv8-jwf6 · published · github[.]com/pocket-id/pocket-id/backend · CRITICAL · Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing
Advisory: https://github.com/advisories/GHSA-rm8c-2cv8-jwf6
The commit: https://github.com/github/advisory-database/commit/403f74092fc8c07ed25c9eebd116dbcccce3ca39
The file: https://github.com/github/advisory-database/blob/403f74092fc8c07ed25c9eebd116dbcccce3ca39/advisories/github-reviewed/2026/11/GHSA-rm8c-2cv8-jwf6/GHSA-rm8c-2cv8-jwf6.json
GHSA-4x48-cgf9-q33f · changed · @novu/api · HIGH · Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Advisory: https://github.com/advisories/GHSA-4x48-cgf9-q33f
The commit: https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33
The file: https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/04/GHSA-4x48-cgf9-q33f/GHSA-4x48-cgf9-q33f.json
GHSA-vg6v-j97m-h5xq · changed · @novu/application-generic · MODERATE · @novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
Advisory: https://github.com/advisories/GHSA-vg6v-j97m-h5xq
The commit: https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33
The file: https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/07/GHSA-vg6v-j97m-h5xq/GHSA-vg6v-j97m-h5xq.json
GHSA-85gg-2gfq-q95m · published · code-graph-rag · HIGH · Code Graph RAG structural tools follow out-of-root symlinks
Advisory: https://github.com/advisories/GHSA-85gg-2gfq-q95m
The commit: https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33
The file: https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/11/GHSA-85gg-2gfq-q95m/GHSA-85gg-2gfq-q95m.json
GHSA-f74m-x83r-c4v4 · published · filegator/filegator · MODERATE · FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
Advisory: https://github.com/advisories/GHSA-f74m-x83r-c4v4
The commit: https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33
The file: https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/11/GHSA-f74m-x83r-c4v4/GHSA-f74m-x83r-c4v4.json
GHSA-gj9m-f8ph-pmhr · published · gpustack · CRITICAL · GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
Advisory: https://github.com/advisories/GHSA-gj9m-f8ph-pmhr
The commit: https://github.com/github/advisory-database/commit/939d98849bbc90d7295a494e321f1e8504d1ce33
The file: https://github.com/github/advisory-database/blob/939d98849bbc90d7295a494e321f1e8504d1ce33/advisories/github-reviewed/2026/11/GHSA-gj9m-f8ph-pmhr/GHSA-gj9m-f8ph-pmhr.json
GHSA-44r8-3p76-84mw · published · filegator/filegator · MODERATE · FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files
Advisory: https://github.com/advisories/GHSA-44r8-3p76-84mw
The commit: https://github.com/github/advisory-database/commit/1021228fec7b44218a3e9ac6d9a899d13eb5dd26
The file: https://github.com/github/advisory-database/blob/1021228fec7b44218a3e9ac6d9a899d13eb5dd26/advisories/github-reviewed/2026/11/GHSA-44r8-3p76-84mw/GHSA-44r8-3p76-84mw.json
GHSA-9qq5-422f-33c2 · published · www[.]velocidex[.]com/golang/velociraptor · MODERATE · Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin
Advisory: https://github.com/advisories/GHSA-9qq5-422f-33c2
The commit: https://github.com/github/advisory-database/commit/b3734c9c566052b56be1a4d31d75f5a5620c6f46
The file: https://github.com/github/advisory-database/blob/b3734c9c566052b56be1a4d31d75f5a5620c6f46/advisories/github-reviewed/2026/11/GHSA-9qq5-422f-33c2/GHSA-9qq5-422f-33c2.json
GHSA-rjr3-43j3-4q8g · published · github[.]com/kubeflow/pipelines · CRITICAL · Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
Advisory: https://github.com/advisories/GHSA-rjr3-43j3-4q8g
The commit: https://github.com/github/advisory-database/commit/b3734c9c566052b56be1a4d31d75f5a5620c6f46
The file: https://github.com/github/advisory-database/blob/b3734c9c566052b56be1a4d31d75f5a5620c6f46/advisories/github-reviewed/2026/11/GHSA-rjr3-43j3-4q8g/GHSA-rjr3-43j3-4q8g.json
GHSA-h89v-g948-47vp · published · moleculer · HIGH · Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
Advisory: https://github.com/advisories/GHSA-h89v-g948-47vp
The commit: https://github.com/github/advisory-database/commit/be7ccaaa5a50cc26fa0f3d9a09a099f55ed875b3
The file: https://github.com/github/advisory-database/blob/be7ccaaa5a50cc26fa0f3d9a09a099f55ed875b3/advisories/github-reviewed/2026/11/GHSA-h89v-g948-47vp/GHSA-h89v-g948-47vp.json
GHSA-9hq4-hm3j-jmph · published · github[.]com/ddev/ddev · HIGH · DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885
Advisory: https://github.com/advisories/GHSA-9hq4-hm3j-jmph
The commit: https://github.com/github/advisory-database/commit/a645cef65b99e828b26daf2d6ada08e377d0fc46
The file: https://github.com/github/advisory-database/blob/a645cef65b99e828b26daf2d6ada08e377d0fc46/advisories/github-reviewed/2026/11/GHSA-9hq4-hm3j-jmph/GHSA-9hq4-hm3j-jmph.json
GHSA-x89h-7h96-v88f · published · github[.]com/schollz/croc/v11 · github[.]com/schollz/croc/v10 · github[.]com/schollz/croc/v9 · github[.]com/schollz/croc/v8 · github[.]com/schollz/croc/v6 · github[.]com/schollz/croc · MODERATE · croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive
Advisory: https://github.com/advisories/GHSA-x89h-7h96-v88f
The commit: https://github.com/github/advisory-database/commit/9b78091ed0ea840196837517e432707a26665b76
The file: https://github.com/github/advisory-database/blob/9b78091ed0ea840196837517e432707a26665b76/advisories/github-reviewed/2026/11/GHSA-x89h-7h96-v88f/GHSA-x89h-7h96-v88f.json
GHSA-2xwh-426q-42c5 · published · github[.]com/kubeflow/pipelines · MODERATE · Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
Advisory: https://github.com/advisories/GHSA-2xwh-426q-42c5
The commit: https://github.com/github/advisory-database/commit/75510e9a2edc82ec797fb06fceb055682b7dda1a
The file: https://github.com/github/advisory-database/blob/75510e9a2edc82ec797fb06fceb055682b7dda1a/advisories/github-reviewed/2026/11/GHSA-2xwh-426q-42c5/GHSA-2xwh-426q-42c5.json
GHSA-5xjx-9qx6-jcrv · published · @anthropic-ai/claude-code · HIGH · Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
Advisory: https://github.com/advisories/GHSA-5xjx-9qx6-jcrv
The commit: https://github.com/github/advisory-database/commit/75510e9a2edc82ec797fb06fceb055682b7dda1a
The file: https://github.com/github/advisory-database/blob/75510e9a2edc82ec797fb06fceb055682b7dda1a/advisories/github-reviewed/2026/11/GHSA-5xjx-9qx6-jcrv/GHSA-5xjx-9qx6-jcrv.json
GHSA-f7vj-6669-qvv4 · published · github[.]com/kubeflow/pipelines · MODERATE · Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation
Advisory: https://github.com/advisories/GHSA-f7vj-6669-qvv4
The commit: https://github.com/github/advisory-database/commit/75510e9a2edc82ec797fb06fceb055682b7dda1a
The file: https://github.com/github/advisory-database/blob/75510e9a2edc82ec797fb06fceb055682b7dda1a/advisories/github-reviewed/2026/11/GHSA-f7vj-6669-qvv4/GHSA-f7vj-6669-qvv4.json
GHSA-ghgh-57qv-h687 · published · github[.]com/kubeflow/pipelines · HIGH · Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
Advisory: https://github.com/advisories/GHSA-ghgh-57qv-h687
The commit: https://github.com/github/advisory-database/commit/43c949c0bc85a8bbc7c12c7391bbc0f4879c093e
The file: https://github.com/github/advisory-database/blob/43c949c0bc85a8bbc7c12c7391bbc0f4879c093e/advisories/github-reviewed/2026/11/GHSA-ghgh-57qv-h687/GHSA-ghgh-57qv-h687.json
GHSA-gcwf-c25f-p9rv · published · kiwitcms · MODERATE · Kiwi TCMS account confirmation open redirect through protocol-relative URLs
Advisory: https://github.com/advisories/GHSA-gcwf-c25f-p9rv
The commit: https://github.com/github/advisory-database/commit/ef91dcbf209cbe30c5e979992aaf24803187a43a
The file: https://github.com/github/advisory-database/blob/ef91dcbf209cbe30c5e979992aaf24803187a43a/advisories/github-reviewed/2026/11/GHSA-gcwf-c25f-p9rv/GHSA-gcwf-c25f-p9rv.json
GHSA-g3qx-frcg-j979 · published · github[.]com/kubeflow/pipelines · MODERATE · Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses
Advisory: https://github.com/advisories/GHSA-g3qx-frcg-j979
The commit: https://github.com/github/advisory-database/commit/ffd82943a698aa62aed95bcc199eb036dc53c899
The file: https://github.com/github/advisory-database/blob/ffd82943a698aa62aed95bcc199eb036dc53c899/advisories/github-reviewed/2026/11/GHSA-g3qx-frcg-j979/GHSA-g3qx-frcg-j979.json
GHSA-r4mx-2gr2-8277 · published · github[.]com/kubeflow/pipelines · MODERATE · Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server
Advisory: https://github.com/advisories/GHSA-r4mx-2gr2-8277
The commit: https://github.com/github/advisory-database/commit/ffd82943a698aa62aed95bcc199eb036dc53c899
The file: https://github.com/github/advisory-database/blob/ffd82943a698aa62aed95bcc199eb036dc53c899/advisories/github-reviewed/2026/11/GHSA-r4mx-2gr2-8277/GHSA-r4mx-2gr2-8277.json
Permanent record: https://flarereef.flareforward.com/n/452