Issues

Issues

• [ChilliCream/graphql-platform] 5 Critical NuGet advisories not in the database after 2 weeks, no CVEs assigned

  github/advisory-database#11142 · opened on Nov 11, 2026

• Withdraw or narrow malware advisories for dependency-confusion packages under @grubhubprod (5 GHSAs, all ">=0")

  github/advisory-database#11066 · opened on Nov 10, 2026

• [NEW] doit - Command Injection (CWE-78)

  github/advisory-database#10994 · opened on Nov 7, 2026

• [GHSA-gcqx-w48m-w2h4] False positive - CVE-2026-93753 is already rejected

  github/advisory-database#10910 · opened on Nov 6, 2026

• Apparent false positive: GHSA-q2mc-9hgr-vmx2 flags [email protected] as malware

  github/advisory-database#10904 · opened on Nov 5, 2026

• Withdraw GHSA-9j83-qj34-g5vc: false-positive malware on @factiii/runner (npm), source MAL-2026-18204 already withdrawn

  github/advisory-database#10891 · opened on Nov 4, 2026

• GHSA-gpgx-58w2-xwwf missing from global advisory database

  github/advisory-database#10841 · opened on Nov 2, 2026

• 54 reviewed advisories still carry a CVE ID that its CNA has rejected (census, 2026-11-01)

  github/advisory-database#10831 · opened on Nov 2, 2026

• GHSA-g3hv-75wg-m249: clarify minimatch 3.1.5 applicability and affected range

  github/advisory-database#10811 · opened on Oct 31, 2026
  7

• Missing advisory for webpki-roots: RUSTSEC-2026-0381 (CVE-2026-111943, emSign root)

  github/advisory-database#10790 · opened on Oct 30, 2026
  2

• Missing CWE records when creating GHSA security report (CWE-1465, CWE-1466, CWE-1470, CWE-1474)

  github/advisory-database#10789 · opened on Oct 30, 2026

• Escalation Request: CVE Assignment stuck for GHSA-6pjw-93c8-87fj and GHSA-v7wv-q5pr-w8pv

  github/advisory-database#10788 · opened on Oct 30, 2026

• Assign finder Credit in CVE-2026-115917

  github/advisory-database#10761 · opened on Oct 29, 2026

• Multiple published repository advisories not appearing in the Advisory Database after 5–16 days

  github/advisory-database#10746 · opened on Oct 28, 2026
  1

• GHSA-f9pq-63hg-w434: version 0.1.1 of @ensdomains/buffer appears to be a legitimate 2023 release, not the Shai-Hulud 2.0 version

  github/advisory-database#10743 · opened on Oct 28, 2026

• Credit + review request: CVE-2026-108100 (GHSA-cwp7-9356-rvxx) & CVE-2026-108101 (GHSA-m2c2-px87-9hp9) — reporter @hackchang per published source advisories

  github/advisory-database#10742 · opened on Oct 28, 2026

• Reviewed advisory GHSA-9v8h-qqgm-4m35 has no CVE alias, so cve_id queries return nothing

  github/advisory-database#10735 · opened on Oct 28, 2026
  1

• Review request: GHSA-p3jp-9v83-76w9 (CVE-2026-111497, .NET Brotli decoder OOB write)

  github/advisory-database#10733 · opened on Oct 28, 2026
  1

• Missing php2shell Advisories? Unable to contribute to the advisory database

  github/advisory-database#10711 · opened on Oct 27, 2026

• [GHSA-v5x3-rpx2-5xp4] Malware advisory for @pingone/net (npm): legitimate package is Ping Identity-internal and never publicly published; affected range ">= 0" is incorrect

  github/advisory-database#10704 · opened on Oct 27, 2026

• GHSA-wqvf-7262-m7g8 is missing in GitHub Advisory Database

  github/advisory-database#10688 · opened on Oct 26, 2026

• ฟ

  github/advisory-database#10538 · opened on Oct 25, 2026

• False positive: GHSA-9wgc-5pgr-25p3 / MAL-2026-18220 (npm "skillward") is a security scanner, not malware

  github/advisory-database#10534 · opened on Oct 24, 2026
  1

• Update GHSA-vhcg-r2h4-gx3m: Scope affected version to =0.4.1 and add patched version 0.4.2 (@syncraft-labs/core)

  github/advisory-database#10518 · opened on Oct 23, 2026

• GitHub-reviewed and GitHub-issued CVEs missing in GitHub Advisory Database

  github/advisory-database#10423 · opened on Oct 18, 2026
  1