Security
GitHub Advisories Security Advisories
Advisory feed healthy
Source: healthy
Track recent GitHub Advisories security advisories, severity, exploit risk, affected products, and remediation information. DTMonitor checks the official source and clearly marks stale or unavailable data instead of assuming the service is healthy.
Active incidents
0
Incidents in 30 days
0
Last verified
Nov 10, 2026, 5:30 AM UTC
Recent GitHub Advisories incident history
Full historyCVE-2026-88984: Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
GitHub Advisories · Nov 9, 2026, 10:48 PM UTC · active
CVE-2026-88968: Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
GitHub Advisories · Nov 9, 2026, 10:42 PM UTC · active
CVE-2026-108262: DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885
GitHub Advisories · Nov 9, 2026, 10:37 PM UTC · active
CVE-2026-97705: Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
GitHub Advisories · Nov 9, 2026, 10:31 PM UTC · active
CVE-2026-77596: Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
GitHub Advisories · Nov 9, 2026, 10:22 PM UTC · active
CVE-2026-87008: Code Graph RAG structural tools follow out-of-root symlinks
GitHub Advisories · Nov 9, 2026, 10:16 PM UTC · active
CVE-2026-102895: GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
GitHub Advisories · Nov 9, 2026, 10:15 PM UTC · active
CVE-2026-115770: Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing
GitHub Advisories · Nov 9, 2026, 10:12 PM UTC · active
CVE-2026-102657: esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal
GitHub Advisories · Nov 9, 2026, 10:03 PM UTC · active
CVE-2026-102340: Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets
GitHub Advisories · Nov 9, 2026, 9:59 PM UTC · active
CVE-2026-102339: Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable
GitHub Advisories · Nov 9, 2026, 9:58 PM UTC · active
CVE-2026-102289: zizmor: Debug logging prints available GitHub credentials in cleartext
GitHub Advisories · Nov 9, 2026, 9:56 PM UTC · active
CVE-2026-75598: Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
GitHub Advisories · Nov 9, 2026, 9:48 PM UTC · active
CVE-2026-77604: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read
GitHub Advisories · Nov 9, 2026, 9:21 PM UTC · active
CVE-2026-62662: Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
GitHub Advisories · Nov 9, 2026, 9:17 PM UTC · active
CVE-2026-76892: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
GitHub Advisories · Nov 9, 2026, 9:13 PM UTC · active
CVE-2026-63655: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
GitHub Advisories · Nov 9, 2026, 9:10 PM UTC · active
CVE-2026-63501: ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)
GitHub Advisories · Nov 9, 2026, 9:08 PM UTC · active
CVE-2026-63198: traQ: Privilege escalation by OAuth prompt=none request
GitHub Advisories · Nov 9, 2026, 8:55 PM UTC · active
CVE-2026-63197: traQ: XSS in the User Uploaded File Retrieval API
GitHub Advisories · Nov 9, 2026, 8:52 PM UTC · active
Source information
Status information is attributed to the provider's official status page or feed. Source freshness is shown separately because an unreachable feed is not evidence that a service is operational.