November 12, 2026
November 12, 2026
On November 12, 2026, GitHub's security advisory list published 49 new advisories, changed 5, and withdrew 0. A security advisory is a public warning about a hole in a piece of software.
- GHSA-45c3-73f7-pv4mPyPI · dnspython · HIGH · dnspython dns[.]name.from_wire_parser() excessive CPU use
- GHSA-w4f7-4cxr-rv3cHex · cowboy, gun · MODERATE · cowboy and gun affected by an HTTP Request/Response Splitting vulnerability
- GHSA-2f3w-v7f5-vpgxNuGet · Aspire[.]Dashboard[.]Sdk[.]linux-x64 · CRITICAL · Duplicate Advisory: Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability
- GHSA-4g86-54fm-h9h8NuGet · Aspire[.]Dashboard[.]Sdk[.]linux-x64, Aspire[.]Dashboard[.]Sdk[.]linux-arm64, Aspire[.]Dashboard[.]Sdk[.]linux-musl-x64, Aspire[.]Dashboard[.]Sdk[.]osx-x64, Aspire[.]Dashboard[.]Sdk[.]osx-arm64, Aspire[.]Dashboard[.]Sdk[.]win-x64, Aspire[.]Dashboard[.]Sdk[.]win-arm64 · CRITICAL · Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability
- GHSA-78fc-9688-w8xwMaven · org[.]openmrs[.]web:openmrs-web · CRITICAL · OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)
- GHSA-w6c6-c85g-mmv6Go · github[.]com/sigstore/cosign/v3, github[.]com/sigstore/cosign/v2, github[.]com/sigstore/cosign · MODERATE · Cosign's verify-blob-attestation reports false positive when payload parsing fails
- GHSA-h24v-f482-8cwfPackagist · code16/sharp · MODERATE · code16/sharp: Arbitrary class instantiation through the embed_key API parameter
- GHSA-g6f8-c3x9-jv7fPackagist · code16/sharp · MODERATE · code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
- GHSA-7m8x-x364-m26jnpm · signalk-server · MODERATE · Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients
- GHSA-8835-xmqj-354hGo · github[.]com/pgEdge/pgedge-go-llm-lib · MODERATE · pgEdge Go LLM Library discloses provider API key fragments in error messages
- GHSA-w437-9mwm-j6vqGo · github[.]com/pgEdge/pgedge-rag-server · MODERATE · pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests
- GHSA-68g8-gh8f-7rhgGo · github[.]com/pgEdge/pgedge-rag-server · MODERATE · pgEdge RAG Server discloses part of the configured provider credential through API error messages
- GHSA-5qg5-rgp6-j5m5Go · github[.]com/pgEdge/pgedge-rag-server · HIGH · pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
- GHSA-vq9p-w6wv-cr25Go · github[.]com/pgEdge/control-plane · HIGH · pgEdge Control Plane generates pg_hba[.]conf with trust authentication for local and loopback connections
- GHSA-h6v6-rg66-fqj4RubyGems · loofah · MODERATE · Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
- GHSA-jcff-cj73-4w4fRubyGems · loofah · MODERATE · Loofah allowed_uri? treats data:text/html as safe text/plain
- GHSA-mf2j-8f84-cc9qRubyGems · loofah · MODERATE · Loofah: Regular expression denial of service in the SVG local-reference check
- GHSA-m3x9-938q-5767RubyGems · loofah · MODERATE · Loofah: CSS url() sanitization bypass via escaped parentheses
- GHSA-p9wj-w8xq-vjx6RubyGems · loofah · MODERATE · Loofah allowed_uri? treats javascript: alert(1) as safe
- GHSA-345x-3rq2-jfrmRubyGems · loofah · MODERATE · Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
- GHSA-jpvv-r467-5p4wnpm · @hono/node-server · MODERATE · @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy
- GHSA-qv5m-9pm6-hqp3npm · @hono/node-server · MODERATE · @hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process
- GHSA-5pm8-86m8-9m6rnpm · basic-ftp · MODERATE · basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client[.]list()
- GHSA-3f4q-8x5m-76v8RubyGems · activestorage · LOW · Active Storage: Possible local file disclosure in video previews and analysis
- GHSA-68p9-83h6-5wpjRubyGems · actionview · MODERATE · Action View: Possible XSS vulnerability in tag helpers
- GHSA-r4jh-29pc-gfqrnpm · basic-ftp · MODERATE · basic-ftp: Uncaught exception crashes the Node[.]js process when a password (or resumed-download path) contains CR/LF
- GHSA-8gmh-2hhj-2hv9RubyGems · addressable · MODERATE · Addressable URI normalization resolves some dotted path segments to the wrong path
- GHSA-9f42-57jx-vpp3RubyGems · addressable · MODERATE · Addressable: Regular Expression Denial of Service in templates with multiple variables
- GHSA-j82w-28jv-3pmjRubyGems · addressable · MODERATE · Addressable: Regular Expression Denial of Service in templates with certain exploded expressions
- GHSA-f4j9-crrj-867qnpm · @astrojs/svelte · LOW · Astro: Reflected XSS via unescaped slot names in @astrojs/svelte
- GHSA-jmv2-qgxf-f995npm · @astrojs/solid-js · LOW · Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js
- GHSA-qq38-m9mg-xjj5RubyGems · addressable · MODERATE · Addressable: Denial of service in URI path normalization
- GHSA-22fx-6r9m-r8h9Go · github[.]com/strukturag/libheif · MODERATE · libheif vulnerable to segmentation fault via floating point exception
- GHSA-539f-xcgw-2gjgRubyGems · addressable · LOW · Addressable display_uri can show misleading hosts containing bidi and invisible characters
- GHSA-9crm-g4mf-wc5jRubyGems · addressable · MODERATE · Addressable display_uri can show misleading hosts with invalid Punycode A-labels
- GHSA-73v3-wf97-vpgjRubyGems · msgpack · HIGH · msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM
- GHSA-gg5j-6742-v827npm · @grpc/grpc-js-xds · MODERATE · @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied
- GHSA-r7hq-q2xm-6c5mnpm · @grpc/grpc-js-xds · MODERATE · @grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation
- GHSA-3gg2-335m-rxc6npm · hono · LOW · Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection
- GHSA-4m76-xfj5-7975npm · hono · MODERATE · Hono: `mount()` and `app[.]mount()` can forward a path that bypasses middleware scoped inside the mount prefix
- GHSA-h7mg-cq63-vhpqnpm · hono · MODERATE · Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator
- GHSA-4h7h-rv7c-7m2vnpm · hono · MODERATE · Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters
- GHSA-46wx-v44x-9hh2npm · hono · MODERATE · Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)
- GHSA-3w93-6hmw-whh4RubyGems · activestorage · MODERATE · Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control
- GHSA-wm3x-v3qw-4jh3RubyGems · actionpack · HIGH · Action Pack: Possible Strong Parameters Bypass in Parameters#each_key
- GHSA-wqgw-9xfh-qf2gPyPI · Pillow · MODERATE · Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data
- GHSA-xcvg-w56q-r89mPyPI · Pillow · HIGH · Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size
- GHSA-2p2f-4rq4-gjwcRubyGems · actionview · MODERATE · Action View: Possible XSS vulnerability in text helpers
- GHSA-rq8q-p985-fjq7RubyGems · actionview · MODERATE · Action View: Possible XSS vulnerability in strip_tags
- GHSA-v6rj-xm57-3p59RubyGems · actionview · MODERATE · Action View: Possible XSS vulnerability in highlight helper
- GHSA-rwvh-fw6r-pwvpRubyGems · actionpack · MODERATE · Action Pack: Possible DoS vulnerability in Action Controller Live streaming
- GHSA-x6mj-8jx9-qhqvRubyGems · actionpack · MODERATE · Action Pack: Possible sensitive session information leak in Active Storage proxy mode
- GHSA-f3w6-w445-fwh9RubyGems · activestorage · CRITICAL · Active Storage: Possible arbitrary file write and read in image analysis
- GHSA-wgv4-95jc-33jmRubyGems · activestorage · CRITICAL · Duplicate Advisory: Active Storage: Possible arbitrary file write and read in Active Storage image analysis