Security advisories (GitHub reviewed), as recorded on Flare Reef (https://flarereef.flareforward.com/p/20) November 11, 2026. On November 11, 2026, GitHub's security advisory list published 24 new advisories, changed 0, and withdrew 0. A security advisory is a public warning about a hole in a piece of software. GHSA-q7j6-px74-p2vw · published · Microsoft[.]DotNet[.]HotReload[.]Watch[.]Aspire · MODERATE · Microsoft Security Advisory CVE-2026-114155 - .NET Elevation of Privilege Vulnerability Advisory: https://github.com/advisories/GHSA-q7j6-px74-p2vw The commit: https://github.com/github/advisory-database/commit/e6fda7a4e68d68d470a906ad1fbb270b3aec880c The file: https://github.com/github/advisory-database/blob/e6fda7a4e68d68d470a906ad1fbb270b3aec880c/advisories/github-reviewed/2026/11/GHSA-q7j6-px74-p2vw/GHSA-q7j6-px74-p2vw.json GHSA-5h82-77p6-2wp3 · published · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86 · MODERATE · Microsoft Security Advisory CVE-2026-118748 - ASP[.]NET Core Denial of Service Vulnerability Advisory: https://github.com/advisories/GHSA-5h82-77p6-2wp3 The commit: https://github.com/github/advisory-database/commit/6b601237d3921eb47b9157ac12d9d878d79af3d9 The file: https://github.com/github/advisory-database/blob/6b601237d3921eb47b9157ac12d9d878d79af3d9/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json GHSA-r33q-3g5w-gqx6 · published · Microsoft[.]TestPlatform[.]CLI · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability Advisory: https://github.com/advisories/GHSA-r33q-3g5w-gqx6 The commit: https://github.com/github/advisory-database/commit/6b601237d3921eb47b9157ac12d9d878d79af3d9 The file: https://github.com/github/advisory-database/blob/6b601237d3921eb47b9157ac12d9d878d79af3d9/advisories/github-reviewed/2026/11/GHSA-r33q-3g5w-gqx6/GHSA-r33q-3g5w-gqx6.json GHSA-6vjv-7wm8-p67r · published · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86 · MODERATE · Microsoft Security Advisory CVE-2026-114150 - ASP[.]NET Core Information Disclosure Vulnerability Advisory: https://github.com/advisories/GHSA-6vjv-7wm8-p67r The commit: https://github.com/github/advisory-database/commit/8213993860ae58fe54a12e551a57af5de30086b4 The file: https://github.com/github/advisory-database/blob/8213993860ae58fe54a12e551a57af5de30086b4/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json GHSA-67wp-ghc2-fw2g · published · Microsoft[.]AspNetCore[.]Http[.]Connections · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86 · HIGH · Microsoft Security Advisory CVE-2026-114146 - ASP[.]NET Core Elevation of Privilege Vulnerability Advisory: https://github.com/advisories/GHSA-67wp-ghc2-fw2g The commit: https://github.com/github/advisory-database/commit/8a351493d8b35a77febed4d69f95e1d83ed8bb5e The file: https://github.com/github/advisory-database/blob/8a351493d8b35a77febed4d69f95e1d83ed8bb5e/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json GHSA-7phj-vgxq-r67h · published · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86 · MODERATE · Microsoft Security Advisory CVE-2026-114157 - ASP[.]NET Core Security Feature Bypass Vulnerability Advisory: https://github.com/advisories/GHSA-7phj-vgxq-r67h The commit: https://github.com/github/advisory-database/commit/8a351493d8b35a77febed4d69f95e1d83ed8bb5e The file: https://github.com/github/advisory-database/blob/8a351493d8b35a77febed4d69f95e1d83ed8bb5e/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json GHSA-8w29-6cjc-h6w4 · published · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86 · MODERATE · Microsoft Security Advisory CVE-2026-114156 - ASP[.]NET Core Security Feature Bypass Vulnerability Advisory: https://github.com/advisories/GHSA-8w29-6cjc-h6w4 The commit: https://github.com/github/advisory-database/commit/8a351493d8b35a77febed4d69f95e1d83ed8bb5e The file: https://github.com/github/advisory-database/blob/8a351493d8b35a77febed4d69f95e1d83ed8bb5e/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json GHSA-r3qf-p3jm-8h4p · published · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86 · MODERATE · Microsoft Security Advisory CVE-2026-109478 - ASP[.]NET Core Denial of Service Vulnerability Advisory: https://github.com/advisories/GHSA-r3qf-p3jm-8h4p The commit: https://github.com/github/advisory-database/commit/8a351493d8b35a77febed4d69f95e1d83ed8bb5e The file: https://github.com/github/advisory-database/blob/8a351493d8b35a77febed4d69f95e1d83ed8bb5e/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json GHSA-wr8v-9x5q-ggcm · published · Microsoft[.]AspNetCore[.]SignalR[.]StackExchangeRedis · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-musl-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]osx-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86 · HIGH · Microsoft Security Advisory CVE-2026-114147 - ASP[.]NET Core Denial of Service Vulnerability Advisory: https://github.com/advisories/GHSA-wr8v-9x5q-ggcm The commit: https://github.com/github/advisory-database/commit/8a351493d8b35a77febed4d69f95e1d83ed8bb5e The file: https://github.com/github/advisory-database/blob/8a351493d8b35a77febed4d69f95e1d83ed8bb5e/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json GHSA-wrm2-c2h2-4w82 · published · Microsoft[.]AspNetCore[.]App[.]Runtime[.]linux-arm · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-109478 - ASP[.]NET Core Denial of Service Vulnerability Advisory: https://github.com/advisories/GHSA-wrm2-c2h2-4w82 The commit: https://github.com/github/advisory-database/commit/8a351493d8b35a77febed4d69f95e1d83ed8bb5e The file: https://github.com/github/advisory-database/blob/8a351493d8b35a77febed4d69f95e1d83ed8bb5e/advisories/github-reviewed/2026/11/GHSA-wrm2-c2h2-4w82/GHSA-wrm2-c2h2-4w82.json GHSA-3893-7fxc-qvff · published · Microsoft[.]AspNetCore[.]Server[.]HttpSys · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-arm64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]AspNetCore[.]App[.]Runtime[.]win-x86 · MODERATE · Microsoft Security Advisory CVE-2026-114154 - ASP[.]NET Core Denial of Service Vulnerability Advisory: https://github.com/advisories/GHSA-3893-7fxc-qvff The commit: https://github.com/github/advisory-database/commit/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f The file: https://github.com/github/advisory-database/blob/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json GHSA-3cgx-w6gm-fqrx · published · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86 · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]NETCore[.]App[.]Runtime[.]win-arm64 · HIGH · Microsoft Security Advisory CVE-2026-114159 - Visual Studio Remote Code Execution Vulnerability Advisory: https://github.com/advisories/GHSA-3cgx-w6gm-fqrx The commit: https://github.com/github/advisory-database/commit/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f The file: https://github.com/github/advisory-database/blob/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json GHSA-6rff-vv3p-7mrw · published · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86 · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-114159 - Visual Studio Remote Code Execution Vulnerability Advisory: https://github.com/advisories/GHSA-6rff-vv3p-7mrw The commit: https://github.com/github/advisory-database/commit/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f The file: https://github.com/github/advisory-database/blob/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f/advisories/github-reviewed/2026/11/GHSA-6rff-vv3p-7mrw/GHSA-6rff-vv3p-7mrw.json GHSA-cjjx-gv54-83qh · published · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86 · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-114158 - Visual Studio Remote Code Execution Vulnerability Advisory: https://github.com/advisories/GHSA-cjjx-gv54-83qh The commit: https://github.com/github/advisory-database/commit/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f The file: https://github.com/github/advisory-database/blob/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f/advisories/github-reviewed/2026/11/GHSA-cjjx-gv54-83qh/GHSA-cjjx-gv54-83qh.json GHSA-m63f-xhvm-6mv5 · published · Aspire[.]Cli · Aspire[.]Cli[.]linux-x64 · Aspire[.]Cli[.]linux-arm64 · Aspire[.]Cli[.]linux-musl-x64 · Aspire[.]Cli[.]osx-x64 · Aspire[.]Cli[.]osx-arm64 · @microsoft/aspire-cli · @microsoft/aspire-cli-linux-x64 · @microsoft/aspire-cli-linux-arm64 · @microsoft/aspire-cli-linux-musl-x64 · @microsoft/aspire-cli-osx-x64 · @microsoft/aspire-cli-osx-arm64 · HIGH · Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability Advisory: https://github.com/advisories/GHSA-m63f-xhvm-6mv5 The commit: https://github.com/github/advisory-database/commit/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f The file: https://github.com/github/advisory-database/blob/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json GHSA-q6jf-24jf-m3cg · published · Aspire[.]Cli · Aspire[.]Cli[.]linux-x64 · Aspire[.]Cli[.]linux-arm64 · Aspire[.]Cli[.]linux-musl-x64 · Aspire[.]Cli[.]osx-x64 · Aspire[.]Cli[.]osx-arm64 · @microsoft/aspire-cli · @microsoft/aspire-cli-linux-x64 · @microsoft/aspire-cli-linux-arm64 · @microsoft/aspire-cli-linux-musl-x64 · @microsoft/aspire-cli-osx-x64 · @microsoft/aspire-cli-osx-arm64 · HIGH · Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability Advisory: https://github.com/advisories/GHSA-q6jf-24jf-m3cg The commit: https://github.com/github/advisory-database/commit/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f The file: https://github.com/github/advisory-database/blob/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json GHSA-r8h3-p8p6-ggp7 · published · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86 · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]NETCore[.]App[.]Runtime[.]win-arm64 · HIGH · Microsoft Security Advisory CVE-2026-114158 - Visual Studio Remote Code Execution Vulnerability Advisory: https://github.com/advisories/GHSA-r8h3-p8p6-ggp7 The commit: https://github.com/github/advisory-database/commit/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f The file: https://github.com/github/advisory-database/blob/fbaf4dd7d5ea9007f940daa2e54798ddabccfa4f/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json GHSA-fpxj-5c99-g7vj · published · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86 · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]NETCore[.]App[.]Runtime[.]win-arm64 · HIGH · Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability Advisory: https://github.com/advisories/GHSA-fpxj-5c99-g7vj The commit: https://github.com/github/advisory-database/commit/262d93ce8edbb5e4d8b4b6f15d8d548da0663e3d The file: https://github.com/github/advisory-database/blob/262d93ce8edbb5e4d8b4b6f15d8d548da0663e3d/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json GHSA-mqcg-252r-5fj7 · published · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86 · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability Advisory: https://github.com/advisories/GHSA-mqcg-252r-5fj7 The commit: https://github.com/github/advisory-database/commit/262d93ce8edbb5e4d8b4b6f15d8d548da0663e3d The file: https://github.com/github/advisory-database/blob/262d93ce8edbb5e4d8b4b6f15d8d548da0663e3d/advisories/github-reviewed/2026/11/GHSA-mqcg-252r-5fj7/GHSA-mqcg-252r-5fj7.json GHSA-6856-87hx-p5x7 · published · Microsoft[.]TestPlatform[.]CLI · MODERATE · Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability Advisory: https://github.com/advisories/GHSA-6856-87hx-p5x7 The commit: https://github.com/github/advisory-database/commit/bb7f2577efe4c93696e33ca34c367cdca1f834ff The file: https://github.com/github/advisory-database/blob/bb7f2577efe4c93696e33ca34c367cdca1f834ff/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json GHSA-cfv6-4v53-fff6 · published · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86 · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-118745 - Visual Studio Remote Code Execution Vulnerability Advisory: https://github.com/advisories/GHSA-cfv6-4v53-fff6 The commit: https://github.com/github/advisory-database/commit/bb7f2577efe4c93696e33ca34c367cdca1f834ff The file: https://github.com/github/advisory-database/blob/bb7f2577efe4c93696e33ca34c367cdca1f834ff/advisories/github-reviewed/2026/11/GHSA-cfv6-4v53-fff6/GHSA-cfv6-4v53-fff6.json GHSA-hm4p-mv9w-4w8f · published · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86 · HIGH · Duplicate Advisory: Microsoft Security Advisory CVE-2026-114152 - Visual Studio Remote Code Execution Vulnerability Advisory: https://github.com/advisories/GHSA-hm4p-mv9w-4w8f The commit: https://github.com/github/advisory-database/commit/bb7f2577efe4c93696e33ca34c367cdca1f834ff The file: https://github.com/github/advisory-database/blob/bb7f2577efe4c93696e33ca34c367cdca1f834ff/advisories/github-reviewed/2026/11/GHSA-hm4p-mv9w-4w8f/GHSA-hm4p-mv9w-4w8f.json GHSA-x8x8-p968-x646 · published · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86 · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]NETCore[.]App[.]Runtime[.]win-arm64 · HIGH · Microsoft Security Advisory CVE-2026-118745 - Visual Studio Remote Code Execution Vulnerability Advisory: https://github.com/advisories/GHSA-x8x8-p968-x646 The commit: https://github.com/github/advisory-database/commit/5ef75ea0bd221d721d359718b055b1167ea6b74b The file: https://github.com/github/advisory-database/blob/5ef75ea0bd221d721d359718b055b1167ea6b74b/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json GHSA-xf35-v9jh-g65w · published · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x86 · Microsoft[.]NETCore[.]App[.]Runtime[.]win-x64 · Microsoft[.]NETCore[.]App[.]Runtime[.]win-arm64 · HIGH · Microsoft Security Advisory CVE-2026-114152 - Visual Studio Remote Code Execution Vulnerability Advisory: https://github.com/advisories/GHSA-xf35-v9jh-g65w The commit: https://github.com/github/advisory-database/commit/5ef75ea0bd221d721d359718b055b1167ea6b74b The file: https://github.com/github/advisory-database/blob/5ef75ea0bd221d721d359718b055b1167ea6b74b/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json Permanent record: https://flarereef.flareforward.com/n/461