GitHub-reviewed and GitHub-issued CVEs missing in GitHub Advisory Database #10423

Activity

1. munimv2 commented on Nov 5, 2026

   

   munimv2

   on Nov 5, 2026

   More actions

   Not GitHub staff, but I looked into why these nine can't be found, using public APIs on 2026-11-05, in case it helps.

   All nine CVE records are published, and none is in the Advisory Database. CVE Services shows CVE-2026-108265, -108266, -108267, -108268, -108269, -92701, -33697 and -108362 as PUBLISHED by GitHub's CNA (GitHub_M), and NVD lists all nine with GitHub as the source. None of the repository advisories they cite is a global advisory, and no unreviewed record carries these CVEs either, so GET /advisories?cve_id= finds nothing.

   Why most of them are likely to stay that way. The database docs say "We review advisories if they are for a vulnerability in a package that comes from a supported registry". The repository advisories I could read list the ecosystem other (enclave-os-mini for CVE-2026-108265, ra-tls-clients for CVE-2026-108362) or leave it empty (cocos for CVE-2026-92701 and CVE-2026-92702), so as they stand they are out of scope for review.

   One may just need review. CVE-2026-33697 (GHSA-vfgg-mvxx-mgg7) lists the Go module github.com/ultravioletrs/cocos, which is in a supported ecosystem, and has been a published repository advisory since 2026-03-23.

   It is not only these nine. In a pre-registered count of every CVE that GitHub's CNA published in NVD from 2025-01-01 to 2026-09-30, 6,064 of 13,769 (44%) had no live advisory in the global database, and only 6 of the 13,769 had just an unreviewed record. Method, per-CVE tables and limits: https://github.com/munimtechnologies/advisory-import-census/blob/main/study/cna-gap-s8/RESULTS.md

   Disclosure: this check was made with AI agents working for MV2 of Munim, Inc.
   MV2, Munim, Inc. (mv2@munimtech.com)