GHSA-rmgv-gcwh-2pqh (CVE-2026-63656) published on repo but missing from global Advisory DB / MITRE / NVD / OSV

Open

#9,171 opened on Aug 20, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Active
Domain: databases, security

Research direction

Start by comparing the repository advisory API response with the global advisory endpoint for GHSA-rmgv-gcwh-2pqh, then check the MITRE, NVD, and OSV endpoints named in the report. Done means the published advisory is present globally and CVE-2026-63656 is available in the downstream records.

Written by the indexing model from the issue text.

Description

Summary

The repository security advisory GHSA-rmgv-gcwh-2pqh (flyimg/flyimg, CVE-2026-63656) was published on 2026-07-30 and the fix shipped in flyimg 1.12.3, but ~3 weeks later the advisory has not been promoted into the global GitHub Advisory Database and the CVE record has not propagated to MITRE, NVD, or OSV.

Advisory

Repo advisory: https://github.com/flyimg/flyimg/security/advisories/GHSA-rmgv-gcwh-2pqh
GHSA: GHSA-rmgv-gcwh-2pqh
CVE: CVE-2026-63656
Affected: flyimg/flyimg (Composer) 0.1.2 <= 1.12.2 — patched in 1.12.3

What I observe (checked 2026-08-20)

gh api repos/flyimg/flyimg/security-advisories/GHSA-rmgv-gcwh-2pqh → state: published, published_at: 2026-07-30T08:19:16Z, cve_id: CVE-2026-63656, patched 1.12.3.
GET https://api.github.com/advisories/GHSA-rmgv-gcwh-2pqh → 404 Not Found (not in the global Advisory Database).
MITRE https://cveawg.mitre.org/api/cve/CVE-2026-63656 → 404 CVE_RECORD_DNE (no record at all, not even RESERVED).
NVD API (cveId=CVE-2026-63656) → 0 results.
OSV.dev (by CVE id and by GHSA id) → 404.

Ask

Please promote this published repo advisory into the global GitHub Advisory Database and push the CVE-2026-63656 record to MITRE so it propagates onward to NVD / OSV / Dependabot. Reporter credited on the advisory: @0xRenSec.

Thanks!

Dominant language: No language data
Stars: 2.5k
Forks: 772
Avg merge: 3d 18h
Merged PRs (30d): 48

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Add: New Channel Pop! Open

channels:add check:passed

Difficulty 1/5 Under an hour Newbie friendliness 90/100

iptv-org/database#36032 · Opened Sep 23, 2026
Fast fail on wrong dbname in profiles.yml Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

confluentinc/dbt-confluent#160 · Opened Sep 23, 2026
harbor-db: missing STOPSIGNAL turns every container stop into an unclean shutdown Open

Difficulty 1/5 Under an hour Newbie friendliness 75/100

goharbor/harbor#23989 · Opened Sep 23, 2026
[Bug] 知识库写入失败：document_storage.py 使用 naive datetime 导致 SQLModel 报错 Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

AstrBotDevs/AstrBot#10205 · Opened Sep 23, 2026
column_count panics when called before the statement is executed Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

duckdb/duckdb-rs#869 · Opened Sep 23, 2026

More Databases issues