November 10, 2026
November 10, 2026
On November 10, 2026, GitHub's security advisory list published 74 new advisories, changed 20, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.
- GHSA-358w-w75h-x6rxGo · github[.]com/gopacket/gopacket · MODERATE · gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments
- GHSA-5m6c-38r8-5w76Go · github[.]com/dagu-org/dagu/v2 · MODERATE · Dagu MCP DAG specification read bypasses path containment and workspace isolation
- GHSA-2h4w-29cv-2cmvPyPI · ag2, autogen · HIGH · AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution
- GHSA-2vgq-wchc-25w7npm · node-forge · LOW · Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
- GHSA-3hch-x692-6qj3PyPI · gpustack · HIGH · GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover
- GHSA-62m9-f875-rqw6PyPI · gpustack · CRITICAL · GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
- GHSA-65v8-q222-64xxPyPI · compose-lint · MODERATE · compose-lint: `fix --apply` can delete a line the user did not select, including a security setting
- GHSA-6f4g-xm8v-pgv6GitHub Actions, PyPI · tmatens/compose-lint, compose-lint · MODERATE · compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
- GHSA-6qrw-m8cv-hcxfnpm · node-forge · HIGH · Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding
- GHSA-6wcv-rj3c-mhv3PyPI, GitHub Actions · compose-lint, tmatens/compose-lint · LOW · compose-lint: .env read through a symlink outside the project can expose the CI job's environment
- GHSA-752m-7p75-49gfnpm · altair-static, altair-express-middleware, altair-koa-middleware, altair-fastify-plugin · MODERATE · Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
- GHSA-88f4-frh5-gmcrPyPI, GitHub Actions · compose-lint, tmatens/compose-lint · LOW · compose-lint: A `.compose-lint[.]yml` symlinked outside the project is read, and a parse error quotes part of the target
- GHSA-8vv3-6qpc-gpw6npm · bitcoinjs-lib · CRITICAL · bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
- GHSA-9wg5-mj3p-v49qnpm · node-forge · LOW · Forge: Certificate signature verified with the issuer's RSA signature scheme
- GHSA-chp3-j5qr-2vfrnpm · @effect/platform, effect · MODERATE · Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
- GHSA-ghwv-vrp2-2975Go · github[.]com/ultravioletrs/cocos · HIGH · Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
- GHSA-h46v-rmh6-fq4fnpm · node-forge · MODERATE · Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
- GHSA-jf3h-8jvx-vcrgPyPI, GitHub Actions · compose-lint, tmatens/compose-lint · LOW · compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings
- GHSA-p623-mxf7-qxjmPyPI · OctoPrint · LOW · OctoPrint: Stored XSS via saved connection parameters
- GHSA-rhr8-3pm8-cq29npm · node-forge · HIGH · Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1[.]fromDer
- GHSA-rm8w-w798-g545PyPI, GitHub Actions · compose-lint, tmatens/compose-lint · LOW · compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`
- GHSA-whr6-fgpq-fpv9PyPI, GitHub Actions · compose-lint, tmatens/compose-lint · LOW · compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output
- GHSA-xggf-m53x-jc3fnpm · node-opcua, node-opcua-address-space, node-opcua-server · CRITICAL · node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
- GHSA-xwgp-w3pj-q5h3npm · @ohif/extension-dicom-pdf · HIGH · OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
- GHSA-xxrh-5hgg-gj4hnpm · @nuxt/content · HIGH · Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API
- GHSA-r7j4-crjv-h467PyPI · compose-lint · MODERATE · compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output
- GHSA-wvg4-6p58-3gh3RubyGems · rack · MODERATE · Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
- GHSA-f9x3-7vq9-cph6Packagist · laravel/framework · CRITICAL · Laravel TokenGuard authentication bypass through non-string API credentials
- GHSA-2j8w-xcrc-x985RubyGems · rack · MODERATE · Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
- GHSA-wrr5-j383-f7h2npm · @nocobase/plugin-action-custom-request · MODERATE · NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides
- GHSA-8hm4-r66f-29wrPackagist · alextselegidis/easyappointments · LOW · Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync
- GHSA-996f-334j-67g7Packagist · alextselegidis/easyappointments · LOW · Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS
- GHSA-pm5p-7w5h-jm5qPackagist · alextselegidis/easyappointments · LOW · Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
- GHSA-p8x9-v4hv-2w4gRubyGems · rack · LOW · Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass
- GHSA-fq3v-74gv-27gmGo · github[.]com/xuri/excelize/v2 · HIGH · Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process
- GHSA-hgj6-7826-r7m5Maven · com[.]fasterxml[.]jackson[.]core:jackson-databind, tools[.]jackson[.]core:jackson-databind · MODERATE · jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
- GHSA-xvh5-g6gv-559vPyPI · Pillow · HIGH · Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
- GHSA-5v64-555j-wjxmRubyGems · rack · HIGH · Rack: Multipart parsing allows DoS via unbounded scan buffer growth
- GHSA-7xw9-549r-8jrcPyPI · DIRAC · HIGH · DIRAC: SQL injection and lack of access control in PilotManager service
- GHSA-m4m7-4cw8-62j6PyPI · DIRAC · CRITICAL · DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval
- GHSA-vg99-gr89-qhw9PyPI · DIRAC · HIGH · DIRAC: Pilot code downloaded over unverified HTTPS connection
- GHSA-pcrw-h46h-c93hnpm · mongoose · CRITICAL · Mongoose: sanitizeFilter not applied on countDocuments
- GHSA-9jpv-c7p4-997xPyPI · DIRAC · CRITICAL · DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input
- GHSA-w5f2-9q9c-ff4hPyPI · lmcache · CRITICAL · LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
- GHSA-wwx6-x28x-8259crates[.]io · russh · HIGH · russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets
- GHSA-m665-v7pm-7grjcrates[.]io · zip · CRITICAL · zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
- GHSA-gg4r-jv3p-qx3cnpm · mongoose · HIGH · Mongoose: Connection-level sanitizeFilter not applied
- GHSA-fm29-4mq3-phg6Packagist · winter/wn-backend-module · HIGH · Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
- GHSA-5cwr-5jxg-pcf6Packagist · winter/wn-backend-module · MODERATE · Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
- GHSA-p2ch-c2c3-4xm5Packagist · winter/wn-backend-module · MODERATE · Winter: CSRF through AJAX handler names reachable as backend page actions
- GHSA-7mpf-4465-7fc2Packagist · winter/wn-backend-module · LOW · Winter: Stored XSS through Backend List widget image columns
- GHSA-hq84-x37p-j6q5Packagist · winter/wn-backend-module · MODERATE · Winter: Reflected XSS through the search query parameter in the backend Table widget
- GHSA-mpmw-f6h6-3g26Packagist · winter/wn-backend-module · MODERATE · Winter: My Account preview exposes another backend user's profile by record ID
- GHSA-6972-9mcm-vhwjnpm · mongoose · MODERATE · Mongoose: Prototype pollution via Schema[.]prototype[.]virtual()
- GHSA-4p39-36wj-23h4RubyGems · nokogiri · LOW · Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
- GHSA-3w22-6jfg-527wRubyGems · nokogiri · LOW · Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value
- GHSA-v995-44v6-5fqmRubyGems · nokogiri · LOW · JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host
- GHSA-8332-j7wj-wjw4npm · mongoose · HIGH · Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
- GHSA-wr5m-5jph-8m96npm · mongoose · MODERATE · Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
- GHSA-474x-hrwr-fgx4npm · fast-xml-parser · LOW · fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags
- GHSA-j8rw-jp99-435vnpm · node-forge · MODERATE · Forge: TLS client crash on a handshake record received without a session
- GHSA-6889-vf6x-f3g5npm · node-forge · LOW · Forge: Ed25519 signature verification accepts small-order public keys
- GHSA-6cv4-p8m7-4r25npm · node-forge · MODERATE · Forge: ReDoS in forge[.]http response header and cookie trimming
- GHSA-w4xr-hqv8-ch44npm · node-forge · MODERATE · Forge: TLS client crash on an unsupported ServerHello compression method
- GHSA-2586-8ghr-69fjRubyGems · actionpack · MODERATE · Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore
- GHSA-2gff-2mmg-m73pRubyGems · actionpack · HIGH · Action Pack: Possible IP spoofing in Action Dispatch RemoteIp
- GHSA-2w9f-fxwj-w2qfRubyGems · activesupport · MODERATE · Active Support: Possible XSS vulnerability in Active Support MessagePack serializer
- GHSA-4v2w-w6g6-f8f8RubyGems · activestorage · MODERATE · Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
- GHSA-5957-c7qm-m469RubyGems · actionmailbox · LOW · Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress
- GHSA-gmj8-hvj3-49mwRubyGems · actionpack · LOW · Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores
- GHSA-r9jg-fmfx-2gv6RubyGems · actionpack · MODERATE · Action Pack: Possible cache poisoning in Action Pack content negotiation
- GHSA-p2pm-g2h6-7j5jRubyGems · activestorage · MODERATE · Active Storage: Possible DoS vulnerability in Active Storage filename handling
- GHSA-8474-xrp6-wh69RubyGems · activesupport · HIGH · Active Support: Possible DoS vulnerability in Active Support safe_constantize
- GHSA-hfr4-8rjc-97m2RubyGems · activestorage · MODERATE · Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
- GHSA-v924-7rp8-4mxhRubyGems · activestorage · HIGH · Active Storage: Possible arbitrary file read and remote code execution in video previews, analysis and image processing
- GHSA-hr4h-4c45-v4q4PyPI · compose-lint · LOW · compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout
- GHSA-xcf7-88g6-7xr8GitHub Actions · tmatens/compose-lint · LOW · compose-lint: Workflow command injection through SARIF-directory errors triggered by pull request symlinks
- GHSA-8v59-qmwv-4p6qPyPI · compose-lint · LOW · compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages
- GHSA-gxg8-5rwf-cg43NuGet · Microsoft[.]AspNetCore[.]SignalR[.]StackExchangeRedis · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-114147 - ASP[.]NET Core Denial of Service Vulnerability
- GHSA-49q5-vjx7-5gwrNuGet · Microsoft[.]AspNetCore[.]Server[.]HttpSys · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-114154 - ASP[.]NET Core Denial of Service Vulnerability
- GHSA-c827-j3xf-67v6NuGet · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm · MODERATE · Duplicate Advisory: Microsoft Security Advisory CVE-2026-114156 - ASP[.]NET Core Security Feature Bypass Vulnerability
- GHSA-95x6-7hq8-2c37NuGet · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64 · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-114157 - ASP[.]NET Core Security Feature Bypass Vulnerability
- GHSA-hfpm-4fc4-g2wcNuGet · Aspire[.]Cli · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability
- GHSA-fgfw-85w4-gx99NuGet · Aspire[.]Cli · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability
- GHSA-xqc2-xf4c-x3h3npm · react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack · CRITICAL · React: Unauthenticated Remote Code Execution in React Server Components
- GHSA-xhj5-c3g8-pfj8NuGet · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86 · MODERATE · Microsoft Security Advisory CVE-2026-109476 - ASP[.]NET Core Information Disclosure Vulnerability
- GHSA-x33c-w48q-qrgcNuGet · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86, Microsoft[.]AspNetCore[.]WebUtilities · HIGH · Microsoft Security Advisory CVE-2026-114149 - ASP[.]NET Core Denial of Service Vulnerability
- GHSA-m28h-pj36-4364NuGet · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86, Microsoft[.]Extensions[.]Validation · MODERATE · Microsoft Security Advisory CVE-2026-118749 - ASP[.]NET Core Denial of Service Vulnerability
- GHSA-vmv3-wvjp-wqpjNuGet · System[.]Formats[.]Cbor · MODERATE · Microsoft Security Advisory CVE-2026-118747 - .NET Denial of Service Vulnerability
- GHSA-3g4v-f5gv-c7xfNuGet · Microsoft[.]NETCore[.]App[.]Runtime[.]linux-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-musl-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-musl-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-musl-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]osx-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]osx-x64 · MODERATE · Microsoft Security Advisory CVE-2026-109475 - .NET Denial of Service Vulnerability
- GHSA-cpw3-h88j-9f6xNuGet · Microsoft[.]NETCore[.]App[.]Runtime[.]linux-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-musl-arm, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-musl-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-musl-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]linux-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]osx-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]osx-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]win-arm64, Microsoft[.]NETCore[.]App[.]Runtime[.]win-x64, Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86, System[.]Text[.]Json · MODERATE · Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability
- GHSA-f7vh-h5g3-7jrhNuGet · Aspire[.]Hosting[.]AppHost, Aspire[.]Hosting · HIGH · Microsoft Security Advisory CVE-2026-120006 - Aspire Elevation of Privilege Vulnerability
- GHSA-6527-9fp8-r4x6NuGet · Microsoft[.]AspNetCore[.]WebUtilities · MODERATE · Microsoft Security Advisory CVE-2026-118750 - ASP[.]NET Core Denial of Service Vulnerability
- GHSA-xw2x-23jm-j582NuGet · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64, Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86 · MODERATE · Microsoft Security Advisory CVE-2026-109481 - ASP[.]NET Core Elevation of Privilege Vulnerability