Security advisories (GitHub reviewed), as recorded on Flare Reef (https://flarereef.flareforward.com/p/20) November 12, 2026. On November 12, 2026, GitHub's security advisory list published 49 new advisories, changed 5, and withdrew 0. A security advisory is a public warning about a hole in a piece of software. GHSA-45c3-73f7-pv4m · changed · dnspython · HIGH · dnspython dns[.]name.from_wire_parser() excessive CPU use Advisory: https://github.com/advisories/GHSA-45c3-73f7-pv4m The commit: https://github.com/github/advisory-database/commit/f5be53f06dad97347eec89ab395f4e6028136fcd The file: https://github.com/github/advisory-database/blob/f5be53f06dad97347eec89ab395f4e6028136fcd/advisories/github-reviewed/2026/10/GHSA-45c3-73f7-pv4m/GHSA-45c3-73f7-pv4m.json GHSA-w4f7-4cxr-rv3c · changed · cowboy · gun · MODERATE · cowboy and gun affected by an HTTP Request/Response Splitting vulnerability Advisory: https://github.com/advisories/GHSA-w4f7-4cxr-rv3c The commit: https://github.com/github/advisory-database/commit/8907a85b8b570b2cb95b3819d70d2290b29630c7 The file: https://github.com/github/advisory-database/blob/8907a85b8b570b2cb95b3819d70d2290b29630c7/advisories/github-reviewed/2026/06/GHSA-w4f7-4cxr-rv3c/GHSA-w4f7-4cxr-rv3c.json GHSA-2f3w-v7f5-vpgx · published · Aspire[.]Dashboard[.]Sdk[.]linux-x64 · CRITICAL · Duplicate Advisory: Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability Advisory: https://github.com/advisories/GHSA-2f3w-v7f5-vpgx The commit: https://github.com/github/advisory-database/commit/f0849a6e194453b260479b27b5926cba75c63e18 The file: https://github.com/github/advisory-database/blob/f0849a6e194453b260479b27b5926cba75c63e18/advisories/github-reviewed/2026/11/GHSA-2f3w-v7f5-vpgx/GHSA-2f3w-v7f5-vpgx.json GHSA-4g86-54fm-h9h8 · published · Aspire[.]Dashboard[.]Sdk[.]linux-x64 · Aspire[.]Dashboard[.]Sdk[.]linux-arm64 · Aspire[.]Dashboard[.]Sdk[.]linux-musl-x64 · Aspire[.]Dashboard[.]Sdk[.]osx-x64 · Aspire[.]Dashboard[.]Sdk[.]osx-arm64 · Aspire[.]Dashboard[.]Sdk[.]win-x64 · Aspire[.]Dashboard[.]Sdk[.]win-arm64 · CRITICAL · Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability Advisory: https://github.com/advisories/GHSA-4g86-54fm-h9h8 The commit: https://github.com/github/advisory-database/commit/e560792cfcc09ff52eef424829c580acdce034f9 The file: https://github.com/github/advisory-database/blob/e560792cfcc09ff52eef424829c580acdce034f9/advisories/github-reviewed/2026/11/GHSA-4g86-54fm-h9h8/GHSA-4g86-54fm-h9h8.json GHSA-78fc-9688-w8xw · changed · org[.]openmrs[.]web:openmrs-web · CRITICAL · OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip) Advisory: https://github.com/advisories/GHSA-78fc-9688-w8xw The commit: https://github.com/github/advisory-database/commit/9f28b46ba2ff65d80071fc71d82da7563af77b90 The file: https://github.com/github/advisory-database/blob/9f28b46ba2ff65d80071fc71d82da7563af77b90/advisories/github-reviewed/2026/05/GHSA-78fc-9688-w8xw/GHSA-78fc-9688-w8xw.json GHSA-w6c6-c85g-mmv6 · changed · github[.]com/sigstore/cosign/v3 · github[.]com/sigstore/cosign/v2 · github[.]com/sigstore/cosign · MODERATE · Cosign's verify-blob-attestation reports false positive when payload parsing fails Advisory: https://github.com/advisories/GHSA-w6c6-c85g-mmv6 The commit: https://github.com/github/advisory-database/commit/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3 The file: https://github.com/github/advisory-database/blob/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3/advisories/github-reviewed/2026/04/GHSA-w6c6-c85g-mmv6/GHSA-w6c6-c85g-mmv6.json GHSA-h24v-f482-8cwf · published · code16/sharp · MODERATE · code16/sharp: Arbitrary class instantiation through the embed_key API parameter Advisory: https://github.com/advisories/GHSA-h24v-f482-8cwf The commit: https://github.com/github/advisory-database/commit/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3 The file: https://github.com/github/advisory-database/blob/5419b97eecce9f12e2b1a2a5806a6a3940d2e6f3/advisories/github-reviewed/2026/11/GHSA-h24v-f482-8cwf/GHSA-h24v-f482-8cwf.json GHSA-g6f8-c3x9-jv7f · published · code16/sharp · MODERATE · code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check Advisory: https://github.com/advisories/GHSA-g6f8-c3x9-jv7f The commit: https://github.com/github/advisory-database/commit/e61a46f83a276df0341911ca65d78dbc586d835b The file: https://github.com/github/advisory-database/blob/e61a46f83a276df0341911ca65d78dbc586d835b/advisories/github-reviewed/2026/11/GHSA-g6f8-c3x9-jv7f/GHSA-g6f8-c3x9-jv7f.json GHSA-7m8x-x364-m26j · published · signalk-server · MODERATE · Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients Advisory: https://github.com/advisories/GHSA-7m8x-x364-m26j The commit: https://github.com/github/advisory-database/commit/1ba2ca7797bbafb4c6002831da11ba970806c7bc The file: https://github.com/github/advisory-database/blob/1ba2ca7797bbafb4c6002831da11ba970806c7bc/advisories/github-reviewed/2026/11/GHSA-7m8x-x364-m26j/GHSA-7m8x-x364-m26j.json GHSA-8835-xmqj-354h · published · github[.]com/pgEdge/pgedge-go-llm-lib · MODERATE · pgEdge Go LLM Library discloses provider API key fragments in error messages Advisory: https://github.com/advisories/GHSA-8835-xmqj-354h The commit: https://github.com/github/advisory-database/commit/567191a5afcc1a3209e981a95a5ef7181e63938c The file: https://github.com/github/advisory-database/blob/567191a5afcc1a3209e981a95a5ef7181e63938c/advisories/github-reviewed/2026/11/GHSA-8835-xmqj-354h/GHSA-8835-xmqj-354h.json GHSA-w437-9mwm-j6vq · published · github[.]com/pgEdge/pgedge-rag-server · MODERATE · pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests Advisory: https://github.com/advisories/GHSA-w437-9mwm-j6vq The commit: https://github.com/github/advisory-database/commit/7c0bdb0568fbb92ddd8d1e265ca65cfbf51b36b0 The file: https://github.com/github/advisory-database/blob/7c0bdb0568fbb92ddd8d1e265ca65cfbf51b36b0/advisories/github-reviewed/2026/11/GHSA-w437-9mwm-j6vq/GHSA-w437-9mwm-j6vq.json GHSA-68g8-gh8f-7rhg · published · github[.]com/pgEdge/pgedge-rag-server · MODERATE · pgEdge RAG Server discloses part of the configured provider credential through API error messages Advisory: https://github.com/advisories/GHSA-68g8-gh8f-7rhg The commit: https://github.com/github/advisory-database/commit/b22a4f89d856aa93f55361580b8566965ca40627 The file: https://github.com/github/advisory-database/blob/b22a4f89d856aa93f55361580b8566965ca40627/advisories/github-reviewed/2026/11/GHSA-68g8-gh8f-7rhg/GHSA-68g8-gh8f-7rhg.json GHSA-5qg5-rgp6-j5m5 · published · github[.]com/pgEdge/pgedge-rag-server · HIGH · pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests Advisory: https://github.com/advisories/GHSA-5qg5-rgp6-j5m5 The commit: https://github.com/github/advisory-database/commit/a2c46f7aa4da77e6a91f1068f35f3f7652d20226 The file: https://github.com/github/advisory-database/blob/a2c46f7aa4da77e6a91f1068f35f3f7652d20226/advisories/github-reviewed/2026/11/GHSA-5qg5-rgp6-j5m5/GHSA-5qg5-rgp6-j5m5.json GHSA-vq9p-w6wv-cr25 · published · github[.]com/pgEdge/control-plane · HIGH · pgEdge Control Plane generates pg_hba[.]conf with trust authentication for local and loopback connections Advisory: https://github.com/advisories/GHSA-vq9p-w6wv-cr25 The commit: https://github.com/github/advisory-database/commit/4c4c219d1d1228122362cd686af326429f8cb05d The file: https://github.com/github/advisory-database/blob/4c4c219d1d1228122362cd686af326429f8cb05d/advisories/github-reviewed/2026/11/GHSA-vq9p-w6wv-cr25/GHSA-vq9p-w6wv-cr25.json GHSA-h6v6-rg66-fqj4 · published · loofah · MODERATE · Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values Advisory: https://github.com/advisories/GHSA-h6v6-rg66-fqj4 The commit: https://github.com/github/advisory-database/commit/4d4116d5150f1278652e17654d4754376576a761 The file: https://github.com/github/advisory-database/blob/4d4116d5150f1278652e17654d4754376576a761/advisories/github-reviewed/2026/11/GHSA-h6v6-rg66-fqj4/GHSA-h6v6-rg66-fqj4.json GHSA-jcff-cj73-4w4f · published · loofah · MODERATE · Loofah allowed_uri? treats data:text/html as safe text/plain Advisory: https://github.com/advisories/GHSA-jcff-cj73-4w4f The commit: https://github.com/github/advisory-database/commit/a480b84910a1e6f0f494ef3a4ec6cae6acd18c70 The file: https://github.com/github/advisory-database/blob/a480b84910a1e6f0f494ef3a4ec6cae6acd18c70/advisories/github-reviewed/2026/11/GHSA-jcff-cj73-4w4f/GHSA-jcff-cj73-4w4f.json GHSA-mf2j-8f84-cc9q · published · loofah · MODERATE · Loofah: Regular expression denial of service in the SVG local-reference check Advisory: https://github.com/advisories/GHSA-mf2j-8f84-cc9q The commit: https://github.com/github/advisory-database/commit/8bab2486d30965fe7aeee7301a0e9734a62bfbdb The file: https://github.com/github/advisory-database/blob/8bab2486d30965fe7aeee7301a0e9734a62bfbdb/advisories/github-reviewed/2026/11/GHSA-mf2j-8f84-cc9q/GHSA-mf2j-8f84-cc9q.json GHSA-m3x9-938q-5767 · published · loofah · MODERATE · Loofah: CSS url() sanitization bypass via escaped parentheses Advisory: https://github.com/advisories/GHSA-m3x9-938q-5767 The commit: https://github.com/github/advisory-database/commit/6129b60c1e199460d2925a7f5e6195fe7e58813c The file: https://github.com/github/advisory-database/blob/6129b60c1e199460d2925a7f5e6195fe7e58813c/advisories/github-reviewed/2026/11/GHSA-m3x9-938q-5767/GHSA-m3x9-938q-5767.json GHSA-p9wj-w8xq-vjx6 · published · loofah · MODERATE · Loofah allowed_uri? treats javascript: alert(1) as safe Advisory: https://github.com/advisories/GHSA-p9wj-w8xq-vjx6 The commit: https://github.com/github/advisory-database/commit/b878b150d18a0f6e5f0bfc8db7e1e3252cbd1357 The file: https://github.com/github/advisory-database/blob/b878b150d18a0f6e5f0bfc8db7e1e3252cbd1357/advisories/github-reviewed/2026/11/GHSA-p9wj-w8xq-vjx6/GHSA-p9wj-w8xq-vjx6.json GHSA-345x-3rq2-jfrm · published · loofah · MODERATE · Loofah: SVG `` and `` bypass local-reference restriction Advisory: https://github.com/advisories/GHSA-345x-3rq2-jfrm The commit: https://github.com/github/advisory-database/commit/c3b271f5334a288082e7b26ba7b441158c572999 The file: https://github.com/github/advisory-database/blob/c3b271f5334a288082e7b26ba7b441158c572999/advisories/github-reviewed/2026/11/GHSA-345x-3rq2-jfrm/GHSA-345x-3rq2-jfrm.json GHSA-jpvv-r467-5p4w · published · @hono/node-server · MODERATE · @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy Advisory: https://github.com/advisories/GHSA-jpvv-r467-5p4w The commit: https://github.com/github/advisory-database/commit/c3b271f5334a288082e7b26ba7b441158c572999 The file: https://github.com/github/advisory-database/blob/c3b271f5334a288082e7b26ba7b441158c572999/advisories/github-reviewed/2026/11/GHSA-jpvv-r467-5p4w/GHSA-jpvv-r467-5p4w.json GHSA-qv5m-9pm6-hqp3 · published · @hono/node-server · MODERATE · @hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process Advisory: https://github.com/advisories/GHSA-qv5m-9pm6-hqp3 The commit: https://github.com/github/advisory-database/commit/67a7c7d40b61b59c524a24d21bfca3c4ba011abc The file: https://github.com/github/advisory-database/blob/67a7c7d40b61b59c524a24d21bfca3c4ba011abc/advisories/github-reviewed/2026/11/GHSA-qv5m-9pm6-hqp3/GHSA-qv5m-9pm6-hqp3.json GHSA-5pm8-86m8-9m6r · published · basic-ftp · MODERATE · basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client[.]list() Advisory: https://github.com/advisories/GHSA-5pm8-86m8-9m6r The commit: https://github.com/github/advisory-database/commit/d91c7de936f9443ed9ee032015813e1be870a16b The file: https://github.com/github/advisory-database/blob/d91c7de936f9443ed9ee032015813e1be870a16b/advisories/github-reviewed/2026/11/GHSA-5pm8-86m8-9m6r/GHSA-5pm8-86m8-9m6r.json GHSA-3f4q-8x5m-76v8 · published · activestorage · LOW · Active Storage: Possible local file disclosure in video previews and analysis Advisory: https://github.com/advisories/GHSA-3f4q-8x5m-76v8 The commit: https://github.com/github/advisory-database/commit/2696adc18ddbf0e1edcf6af99b3bc1125c25677c The file: https://github.com/github/advisory-database/blob/2696adc18ddbf0e1edcf6af99b3bc1125c25677c/advisories/github-reviewed/2026/11/GHSA-3f4q-8x5m-76v8/GHSA-3f4q-8x5m-76v8.json GHSA-68p9-83h6-5wpj · published · actionview · MODERATE · Action View: Possible XSS vulnerability in tag helpers Advisory: https://github.com/advisories/GHSA-68p9-83h6-5wpj The commit: https://github.com/github/advisory-database/commit/71381136d41b61e0a6962e2fe041d7ea16e45e0b The file: https://github.com/github/advisory-database/blob/71381136d41b61e0a6962e2fe041d7ea16e45e0b/advisories/github-reviewed/2026/11/GHSA-68p9-83h6-5wpj/GHSA-68p9-83h6-5wpj.json GHSA-r4jh-29pc-gfqr · published · basic-ftp · MODERATE · basic-ftp: Uncaught exception crashes the Node[.]js process when a password (or resumed-download path) contains CR/LF Advisory: https://github.com/advisories/GHSA-r4jh-29pc-gfqr The commit: https://github.com/github/advisory-database/commit/01e8968af3d25281248763c5561250b20c02d08c The file: https://github.com/github/advisory-database/blob/01e8968af3d25281248763c5561250b20c02d08c/advisories/github-reviewed/2026/11/GHSA-r4jh-29pc-gfqr/GHSA-r4jh-29pc-gfqr.json GHSA-8gmh-2hhj-2hv9 · published · addressable · MODERATE · Addressable URI normalization resolves some dotted path segments to the wrong path Advisory: https://github.com/advisories/GHSA-8gmh-2hhj-2hv9 The commit: https://github.com/github/advisory-database/commit/1c66f990487abe2b5e691d9f67f9587c3d2bc076 The file: https://github.com/github/advisory-database/blob/1c66f990487abe2b5e691d9f67f9587c3d2bc076/advisories/github-reviewed/2026/11/GHSA-8gmh-2hhj-2hv9/GHSA-8gmh-2hhj-2hv9.json GHSA-9f42-57jx-vpp3 · published · addressable · MODERATE · Addressable: Regular Expression Denial of Service in templates with multiple variables Advisory: https://github.com/advisories/GHSA-9f42-57jx-vpp3 The commit: https://github.com/github/advisory-database/commit/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a The file: https://github.com/github/advisory-database/blob/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a/advisories/github-reviewed/2026/11/GHSA-9f42-57jx-vpp3/GHSA-9f42-57jx-vpp3.json GHSA-j82w-28jv-3pmj · published · addressable · MODERATE · Addressable: Regular Expression Denial of Service in templates with certain exploded expressions Advisory: https://github.com/advisories/GHSA-j82w-28jv-3pmj The commit: https://github.com/github/advisory-database/commit/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a The file: https://github.com/github/advisory-database/blob/cb1ce7cc1ab281508e06a41b86b79c32578f4b8a/advisories/github-reviewed/2026/11/GHSA-j82w-28jv-3pmj/GHSA-j82w-28jv-3pmj.json GHSA-f4j9-crrj-867q · published · @astrojs/svelte · LOW · Astro: Reflected XSS via unescaped slot names in @astrojs/svelte Advisory: https://github.com/advisories/GHSA-f4j9-crrj-867q The commit: https://github.com/github/advisory-database/commit/00ace44fceb84a0a31512db616bd95a1e75e1735 The file: https://github.com/github/advisory-database/blob/00ace44fceb84a0a31512db616bd95a1e75e1735/advisories/github-reviewed/2026/11/GHSA-f4j9-crrj-867q/GHSA-f4j9-crrj-867q.json GHSA-jmv2-qgxf-f995 · published · @astrojs/solid-js · LOW · Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js Advisory: https://github.com/advisories/GHSA-jmv2-qgxf-f995 The commit: https://github.com/github/advisory-database/commit/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17 The file: https://github.com/github/advisory-database/blob/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17/advisories/github-reviewed/2026/11/GHSA-jmv2-qgxf-f995/GHSA-jmv2-qgxf-f995.json GHSA-qq38-m9mg-xjj5 · published · addressable · MODERATE · Addressable: Denial of service in URI path normalization Advisory: https://github.com/advisories/GHSA-qq38-m9mg-xjj5 The commit: https://github.com/github/advisory-database/commit/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17 The file: https://github.com/github/advisory-database/blob/4aa43f0c7e82a700aeaf59c85aec8f43c4fa3c17/advisories/github-reviewed/2026/11/GHSA-qq38-m9mg-xjj5/GHSA-qq38-m9mg-xjj5.json GHSA-22fx-6r9m-r8h9 · changed · github[.]com/strukturag/libheif · MODERATE · libheif vulnerable to segmentation fault via floating point exception Advisory: https://github.com/advisories/GHSA-22fx-6r9m-r8h9 The commit: https://github.com/github/advisory-database/commit/e205b510dfe7e69e9324b2b3af3028598f3df97c The file: https://github.com/github/advisory-database/blob/e205b510dfe7e69e9324b2b3af3028598f3df97c/advisories/github-reviewed/2023/05/GHSA-22fx-6r9m-r8h9/GHSA-22fx-6r9m-r8h9.json GHSA-539f-xcgw-2gjg · published · addressable · LOW · Addressable display_uri can show misleading hosts containing bidi and invisible characters Advisory: https://github.com/advisories/GHSA-539f-xcgw-2gjg The commit: https://github.com/github/advisory-database/commit/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487 The file: https://github.com/github/advisory-database/blob/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487/advisories/github-reviewed/2026/11/GHSA-539f-xcgw-2gjg/GHSA-539f-xcgw-2gjg.json GHSA-9crm-g4mf-wc5j · published · addressable · MODERATE · Addressable display_uri can show misleading hosts with invalid Punycode A-labels Advisory: https://github.com/advisories/GHSA-9crm-g4mf-wc5j The commit: https://github.com/github/advisory-database/commit/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487 The file: https://github.com/github/advisory-database/blob/e1a7f0c29ab69e277f7f4e8d2c6be5b399a57487/advisories/github-reviewed/2026/11/GHSA-9crm-g4mf-wc5j/GHSA-9crm-g4mf-wc5j.json GHSA-73v3-wf97-vpgj · published · msgpack · HIGH · msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM Advisory: https://github.com/advisories/GHSA-73v3-wf97-vpgj The commit: https://github.com/github/advisory-database/commit/3171910415f877765a1635d1c70d7274932baa3f The file: https://github.com/github/advisory-database/blob/3171910415f877765a1635d1c70d7274932baa3f/advisories/github-reviewed/2026/11/GHSA-73v3-wf97-vpgj/GHSA-73v3-wf97-vpgj.json GHSA-gg5j-6742-v827 · published · @grpc/grpc-js-xds · MODERATE · @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied Advisory: https://github.com/advisories/GHSA-gg5j-6742-v827 The commit: https://github.com/github/advisory-database/commit/6cb475c27ff368dee6735c8d6fb1fcb883f08a06 The file: https://github.com/github/advisory-database/blob/6cb475c27ff368dee6735c8d6fb1fcb883f08a06/advisories/github-reviewed/2026/11/GHSA-gg5j-6742-v827/GHSA-gg5j-6742-v827.json GHSA-r7hq-q2xm-6c5m · published · @grpc/grpc-js-xds · MODERATE · @grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation Advisory: https://github.com/advisories/GHSA-r7hq-q2xm-6c5m The commit: https://github.com/github/advisory-database/commit/065329326fcdec6f14d08500418cbcdceb8c6028 The file: https://github.com/github/advisory-database/blob/065329326fcdec6f14d08500418cbcdceb8c6028/advisories/github-reviewed/2026/11/GHSA-r7hq-q2xm-6c5m/GHSA-r7hq-q2xm-6c5m.json GHSA-3gg2-335m-rxc6 · published · hono · LOW · Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection Advisory: https://github.com/advisories/GHSA-3gg2-335m-rxc6 The commit: https://github.com/github/advisory-database/commit/1d2ec873ee46d959c071559657664272578a25a3 The file: https://github.com/github/advisory-database/blob/1d2ec873ee46d959c071559657664272578a25a3/advisories/github-reviewed/2026/11/GHSA-3gg2-335m-rxc6/GHSA-3gg2-335m-rxc6.json GHSA-4m76-xfj5-7975 · published · hono · MODERATE · Hono: `mount()` and `app[.]mount()` can forward a path that bypasses middleware scoped inside the mount prefix Advisory: https://github.com/advisories/GHSA-4m76-xfj5-7975 The commit: https://github.com/github/advisory-database/commit/1d2ec873ee46d959c071559657664272578a25a3 The file: https://github.com/github/advisory-database/blob/1d2ec873ee46d959c071559657664272578a25a3/advisories/github-reviewed/2026/11/GHSA-4m76-xfj5-7975/GHSA-4m76-xfj5-7975.json GHSA-h7mg-cq63-vhpq · published · hono · MODERATE · Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator Advisory: https://github.com/advisories/GHSA-h7mg-cq63-vhpq The commit: https://github.com/github/advisory-database/commit/1d2ec873ee46d959c071559657664272578a25a3 The file: https://github.com/github/advisory-database/blob/1d2ec873ee46d959c071559657664272578a25a3/advisories/github-reviewed/2026/11/GHSA-h7mg-cq63-vhpq/GHSA-h7mg-cq63-vhpq.json GHSA-4h7h-rv7c-7m2v · published · hono · MODERATE · Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters Advisory: https://github.com/advisories/GHSA-4h7h-rv7c-7m2v The commit: https://github.com/github/advisory-database/commit/c6aa3a3a300705d4948b4bbfbcf25fdf0cf8a1fb The file: https://github.com/github/advisory-database/blob/c6aa3a3a300705d4948b4bbfbcf25fdf0cf8a1fb/advisories/github-reviewed/2026/11/GHSA-4h7h-rv7c-7m2v/GHSA-4h7h-rv7c-7m2v.json GHSA-46wx-v44x-9hh2 · published · hono · MODERATE · Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`) Advisory: https://github.com/advisories/GHSA-46wx-v44x-9hh2 The commit: https://github.com/github/advisory-database/commit/627e9e9022715e52f79f6e4b114edce60db4edf1 The file: https://github.com/github/advisory-database/blob/627e9e9022715e52f79f6e4b114edce60db4edf1/advisories/github-reviewed/2026/11/GHSA-46wx-v44x-9hh2/GHSA-46wx-v44x-9hh2.json GHSA-3w93-6hmw-whh4 · published · activestorage · MODERATE · Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control Advisory: https://github.com/advisories/GHSA-3w93-6hmw-whh4 The commit: https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928 The file: https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-3w93-6hmw-whh4/GHSA-3w93-6hmw-whh4.json GHSA-wm3x-v3qw-4jh3 · published · actionpack · HIGH · Action Pack: Possible Strong Parameters Bypass in Parameters#each_key Advisory: https://github.com/advisories/GHSA-wm3x-v3qw-4jh3 The commit: https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928 The file: https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-wm3x-v3qw-4jh3/GHSA-wm3x-v3qw-4jh3.json GHSA-wqgw-9xfh-qf2g · published · Pillow · MODERATE · Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data Advisory: https://github.com/advisories/GHSA-wqgw-9xfh-qf2g The commit: https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928 The file: https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-wqgw-9xfh-qf2g/GHSA-wqgw-9xfh-qf2g.json GHSA-xcvg-w56q-r89m · published · Pillow · HIGH · Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size Advisory: https://github.com/advisories/GHSA-xcvg-w56q-r89m The commit: https://github.com/github/advisory-database/commit/ee2646afeee365f1debf88e8feb0a1264b13f928 The file: https://github.com/github/advisory-database/blob/ee2646afeee365f1debf88e8feb0a1264b13f928/advisories/github-reviewed/2026/11/GHSA-xcvg-w56q-r89m/GHSA-xcvg-w56q-r89m.json GHSA-2p2f-4rq4-gjwc · published · actionview · MODERATE · Action View: Possible XSS vulnerability in text helpers Advisory: https://github.com/advisories/GHSA-2p2f-4rq4-gjwc The commit: https://github.com/github/advisory-database/commit/7ac5fec35965b4232c0784cd79ee89b565e06a05 The file: https://github.com/github/advisory-database/blob/7ac5fec35965b4232c0784cd79ee89b565e06a05/advisories/github-reviewed/2026/11/GHSA-2p2f-4rq4-gjwc/GHSA-2p2f-4rq4-gjwc.json GHSA-rq8q-p985-fjq7 · published · actionview · MODERATE · Action View: Possible XSS vulnerability in strip_tags Advisory: https://github.com/advisories/GHSA-rq8q-p985-fjq7 The commit: https://github.com/github/advisory-database/commit/7ac5fec35965b4232c0784cd79ee89b565e06a05 The file: https://github.com/github/advisory-database/blob/7ac5fec35965b4232c0784cd79ee89b565e06a05/advisories/github-reviewed/2026/11/GHSA-rq8q-p985-fjq7/GHSA-rq8q-p985-fjq7.json GHSA-v6rj-xm57-3p59 · published · actionview · MODERATE · Action View: Possible XSS vulnerability in highlight helper Advisory: https://github.com/advisories/GHSA-v6rj-xm57-3p59 The commit: https://github.com/github/advisory-database/commit/7ac5fec35965b4232c0784cd79ee89b565e06a05 The file: https://github.com/github/advisory-database/blob/7ac5fec35965b4232c0784cd79ee89b565e06a05/advisories/github-reviewed/2026/11/GHSA-v6rj-xm57-3p59/GHSA-v6rj-xm57-3p59.json GHSA-rwvh-fw6r-pwvp · published · actionpack · MODERATE · Action Pack: Possible DoS vulnerability in Action Controller Live streaming Advisory: https://github.com/advisories/GHSA-rwvh-fw6r-pwvp The commit: https://github.com/github/advisory-database/commit/89e35a6136da4b6fef645503a1ddcd7ff496f51e The file: https://github.com/github/advisory-database/blob/89e35a6136da4b6fef645503a1ddcd7ff496f51e/advisories/github-reviewed/2026/11/GHSA-rwvh-fw6r-pwvp/GHSA-rwvh-fw6r-pwvp.json GHSA-x6mj-8jx9-qhqv · published · actionpack · MODERATE · Action Pack: Possible sensitive session information leak in Active Storage proxy mode Advisory: https://github.com/advisories/GHSA-x6mj-8jx9-qhqv The commit: https://github.com/github/advisory-database/commit/89e35a6136da4b6fef645503a1ddcd7ff496f51e The file: https://github.com/github/advisory-database/blob/89e35a6136da4b6fef645503a1ddcd7ff496f51e/advisories/github-reviewed/2026/11/GHSA-x6mj-8jx9-qhqv/GHSA-x6mj-8jx9-qhqv.json GHSA-f3w6-w445-fwh9 · published · activestorage · CRITICAL · Active Storage: Possible arbitrary file write and read in image analysis Advisory: https://github.com/advisories/GHSA-f3w6-w445-fwh9 The commit: https://github.com/github/advisory-database/commit/a0dc66bb031dd931c8f7037f2c2adf1196b064d7 The file: https://github.com/github/advisory-database/blob/a0dc66bb031dd931c8f7037f2c2adf1196b064d7/advisories/github-reviewed/2026/11/GHSA-f3w6-w445-fwh9/GHSA-f3w6-w445-fwh9.json GHSA-wgv4-95jc-33jm · published · activestorage · CRITICAL · Duplicate Advisory: Active Storage: Possible arbitrary file write and read in Active Storage image analysis Advisory: https://github.com/advisories/GHSA-wgv4-95jc-33jm The commit: https://github.com/github/advisory-database/commit/a0dc66bb031dd931c8f7037f2c2adf1196b064d7 The file: https://github.com/github/advisory-database/blob/a0dc66bb031dd931c8f7037f2c2adf1196b064d7/advisories/github-reviewed/2026/11/GHSA-wgv4-95jc-33jm/GHSA-wgv4-95jc-33jm.json Permanent record: https://flarereef.flareforward.com/n/465