{"schema_version":"2","view":"grouped","data":[{"id":73183,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-w73v-3cj5-3qjx","summary":"CGA-w73v-3cj5-3qjx","evidence":"osv:CGA-w73v-3cj5-3qjx","products":[{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w73v-3cj5-3qjx","aliases":["CGA-w73v-3cj5-3qjx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/chainguard/opensearch-dashboards-3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w73v-3cj5-3qjx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:50:33Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/wolfi/opensearch-dashboards-3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w73v-3cj5-3qjx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:50:33Z"}]}}],"modified":"2026-10-03T10:42:47.209735629Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3aad7736-4c51-471f-8465-6a46e96c7160","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w73v-3cj5-3qjx","advisory_id":"3aad7736-4c51-471f-8465-6a46e96c7160","event_types":["advisory"],"published_at":"2026-10-26T03:37:58.302743+00:00","technologies":["core-osv","opensearch-dashboards-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T05:07:13+00:00","detail_url":"/advisories/advisory%3A3aad7736-4c51-471f-8465-6a46e96c7160","group":{"id":"advisory:3aad7736-4c51-471f-8465-6a46e96c7160","revision":1,"primary_event_id":75198,"change":"published","superseded_by":[],"changed":{"id":75198,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-w73v-3cj5-3qjx","summary":"CGA-w73v-3cj5-3qjx","evidence":"osv:CGA-w73v-3cj5-3qjx","products":[{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w73v-3cj5-3qjx","aliases":["CGA-w73v-3cj5-3qjx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/chainguard/opensearch-dashboards-3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w73v-3cj5-3qjx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:50:33Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/wolfi/opensearch-dashboards-3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w73v-3cj5-3qjx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:50:33Z"}]}}],"modified":"2026-10-03T10:42:47.209735629Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3aad7736-4c51-471f-8465-6a46e96c7160","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w73v-3cj5-3qjx","advisory_id":"3aad7736-4c51-471f-8465-6a46e96c7160","event_types":["advisory"],"published_at":"2026-10-26T03:37:58.302743+00:00","technologies":["core-osv","opensearch-dashboards-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T05:07:13+00:00","detail_url":"/events/75198"},"members":[{"id":75198,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-w73v-3cj5-3qjx","summary":"CGA-w73v-3cj5-3qjx","evidence":"osv:CGA-w73v-3cj5-3qjx","products":[{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w73v-3cj5-3qjx","aliases":["CGA-w73v-3cj5-3qjx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/chainguard/opensearch-dashboards-3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w73v-3cj5-3qjx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:50:33Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/wolfi/opensearch-dashboards-3?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w73v-3cj5-3qjx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:50:33Z"}]}}],"modified":"2026-10-03T10:42:47.209735629Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3aad7736-4c51-471f-8465-6a46e96c7160","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w73v-3cj5-3qjx","advisory_id":"3aad7736-4c51-471f-8465-6a46e96c7160","event_types":["advisory"],"published_at":"2026-10-26T03:37:58.302743+00:00","technologies":["core-osv","opensearch-dashboards-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T05:07:13+00:00","detail_url":"/events/75198"}]}},{"id":73166,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-jpwf-f5q5-w9v4","summary":"CGA-jpwf-f5q5-w9v4","evidence":"osv:CGA-jpwf-f5q5-w9v4","products":[{"name":{"value":"prism","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"prism","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jpwf-f5q5-w9v4","aliases":["CGA-jpwf-f5q5-w9v4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/chainguard/prism?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jpwf-f5q5-w9v4.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:58:28Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/wolfi/prism?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jpwf-f5q5-w9v4.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:58:28Z"}]}}],"modified":"2026-10-03T10:32:53.254709427Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c50d5095-0379-4ef4-b874-7bac11b672a4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jpwf-f5q5-w9v4","advisory_id":"c50d5095-0379-4ef4-b874-7bac11b672a4","event_types":["advisory"],"published_at":"2026-10-26T03:37:19.539231+00:00","technologies":["core-osv","prism"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:54:24+00:00","detail_url":"/advisories/advisory%3Ac50d5095-0379-4ef4-b874-7bac11b672a4","group":{"id":"advisory:c50d5095-0379-4ef4-b874-7bac11b672a4","revision":1,"primary_event_id":75178,"change":"published","superseded_by":[],"changed":{"id":75178,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-jpwf-f5q5-w9v4","summary":"CGA-jpwf-f5q5-w9v4","evidence":"osv:CGA-jpwf-f5q5-w9v4","products":[{"name":{"value":"prism","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"prism","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jpwf-f5q5-w9v4","aliases":["CGA-jpwf-f5q5-w9v4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/chainguard/prism?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jpwf-f5q5-w9v4.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:58:28Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/wolfi/prism?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jpwf-f5q5-w9v4.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:58:28Z"}]}}],"modified":"2026-10-03T10:32:53.254709427Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c50d5095-0379-4ef4-b874-7bac11b672a4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jpwf-f5q5-w9v4","advisory_id":"c50d5095-0379-4ef4-b874-7bac11b672a4","event_types":["advisory"],"published_at":"2026-10-26T03:37:19.539231+00:00","technologies":["core-osv","prism"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:54:24+00:00","detail_url":"/events/75178"},"members":[{"id":75178,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-jpwf-f5q5-w9v4","summary":"CGA-jpwf-f5q5-w9v4","evidence":"osv:CGA-jpwf-f5q5-w9v4","products":[{"name":{"value":"prism","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"prism","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jpwf-f5q5-w9v4","aliases":["CGA-jpwf-f5q5-w9v4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/chainguard/prism?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jpwf-f5q5-w9v4.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:58:28Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/wolfi/prism?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jpwf-f5q5-w9v4.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T00:58:28Z"}]}}],"modified":"2026-10-03T10:32:53.254709427Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c50d5095-0379-4ef4-b874-7bac11b672a4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jpwf-f5q5-w9v4","advisory_id":"c50d5095-0379-4ef4-b874-7bac11b672a4","event_types":["advisory"],"published_at":"2026-10-26T03:37:19.539231+00:00","technologies":["core-osv","prism"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:54:24+00:00","detail_url":"/events/75178"}]}},{"id":73160,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-xxx2-79p6-wm88","summary":"CGA-xxx2-79p6-wm88","evidence":"osv:CGA-xxx2-79p6-wm88","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xxx2-79p6-wm88","aliases":["CGA-xxx2-79p6-wm88"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xxx2-79p6-wm88.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuh/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:52:12Z"}]}}],"modified":"2026-10-03T10:32:50.865714962Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a47f43b2-b1b7-48c2-9727-fe043d284539","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xxx2-79p6-wm88","advisory_id":"a47f43b2-b1b7-48c2-9727-fe043d284539","event_types":["advisory"],"published_at":"2026-10-26T03:35:56.434233+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:22:42+00:00","detail_url":"/advisories/advisory%3Aa47f43b2-b1b7-48c2-9727-fe043d284539","group":{"id":"advisory:a47f43b2-b1b7-48c2-9727-fe043d284539","revision":1,"primary_event_id":75160,"change":"published","superseded_by":[],"changed":{"id":75160,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-xxx2-79p6-wm88","summary":"CGA-xxx2-79p6-wm88","evidence":"osv:CGA-xxx2-79p6-wm88","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xxx2-79p6-wm88","aliases":["CGA-xxx2-79p6-wm88"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xxx2-79p6-wm88.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuh/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:52:12Z"}]}}],"modified":"2026-10-03T10:32:50.865714962Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a47f43b2-b1b7-48c2-9727-fe043d284539","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xxx2-79p6-wm88","advisory_id":"a47f43b2-b1b7-48c2-9727-fe043d284539","event_types":["advisory"],"published_at":"2026-10-26T03:35:56.434233+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:22:42+00:00","detail_url":"/events/75160"},"members":[{"id":75160,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-xxx2-79p6-wm88","summary":"CGA-xxx2-79p6-wm88","evidence":"osv:CGA-xxx2-79p6-wm88","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xxx2-79p6-wm88","aliases":["CGA-xxx2-79p6-wm88"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xxx2-79p6-wm88.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuh/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:52:12Z"}]}}],"modified":"2026-10-03T10:32:50.865714962Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a47f43b2-b1b7-48c2-9727-fe043d284539","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xxx2-79p6-wm88","advisory_id":"a47f43b2-b1b7-48c2-9727-fe043d284539","event_types":["advisory"],"published_at":"2026-10-26T03:35:56.434233+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:22:42+00:00","detail_url":"/events/75160"}]}},{"id":72975,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-hxjf-mfr7-fvp2","summary":"CGA-hxjf-mfr7-fvp2","evidence":"osv:CGA-hxjf-mfr7-fvp2","products":[{"name":{"value":"prism","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"prism","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hxjf-mfr7-fvp2","aliases":["CGA-hxjf-mfr7-fvp2"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/chainguard/prism?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hxjf-mfr7-fvp2.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:28:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/wolfi/prism?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hxjf-mfr7-fvp2.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:28:27Z"}]}}],"modified":"2026-10-03T10:32:43.061121603Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6798e833-3ab7-4277-9f40-728040191ebc","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hxjf-mfr7-fvp2","advisory_id":"6798e833-3ab7-4277-9f40-728040191ebc","event_types":["advisory"],"published_at":"2026-10-26T02:05:27.901812+00:00","technologies":["core-osv","prism"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:38:30+00:00","detail_url":"/advisories/advisory%3A6798e833-3ab7-4277-9f40-728040191ebc","group":{"id":"advisory:6798e833-3ab7-4277-9f40-728040191ebc","revision":1,"primary_event_id":74243,"change":"published","superseded_by":[],"changed":{"id":74243,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-hxjf-mfr7-fvp2","summary":"CGA-hxjf-mfr7-fvp2","evidence":"osv:CGA-hxjf-mfr7-fvp2","products":[{"name":{"value":"prism","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"prism","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hxjf-mfr7-fvp2","aliases":["CGA-hxjf-mfr7-fvp2"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/chainguard/prism?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hxjf-mfr7-fvp2.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:28:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/wolfi/prism?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hxjf-mfr7-fvp2.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:28:27Z"}]}}],"modified":"2026-10-03T10:32:43.061121603Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6798e833-3ab7-4277-9f40-728040191ebc","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hxjf-mfr7-fvp2","advisory_id":"6798e833-3ab7-4277-9f40-728040191ebc","event_types":["advisory"],"published_at":"2026-10-26T02:05:27.901812+00:00","technologies":["core-osv","prism"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:38:30+00:00","detail_url":"/events/74243"},"members":[{"id":74243,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-hxjf-mfr7-fvp2","summary":"CGA-hxjf-mfr7-fvp2","evidence":"osv:CGA-hxjf-mfr7-fvp2","products":[{"name":{"value":"prism","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"prism","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r13","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hxjf-mfr7-fvp2","aliases":["CGA-hxjf-mfr7-fvp2"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/chainguard/prism?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hxjf-mfr7-fvp2.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:28:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r13"}]}],"package":{"name":"prism","purl":"pkg:apk/wolfi/prism?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hxjf-mfr7-fvp2.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/src/prism/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:28:27Z"}]}}],"modified":"2026-10-03T10:32:43.061121603Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6798e833-3ab7-4277-9f40-728040191ebc","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hxjf-mfr7-fvp2","advisory_id":"6798e833-3ab7-4277-9f40-728040191ebc","event_types":["advisory"],"published_at":"2026-10-26T02:05:27.901812+00:00","technologies":["core-osv","prism"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:38:30+00:00","detail_url":"/events/74243"}]}},{"id":72910,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-fjm5-2v25-22g4","summary":"CGA-fjm5-2v25-22g4","evidence":"osv:CGA-fjm5-2v25-22g4","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fjm5-2v25-22g4","aliases":["CGA-fjm5-2v25-22g4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjm5-2v25-22g4.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCore/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:52:12Z"}]}}],"modified":"2026-10-03T10:32:40.113363443Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:eb3f896f-b067-4661-b773-405c87d7728e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fjm5-2v25-22g4","advisory_id":"eb3f896f-b067-4661-b773-405c87d7728e","event_types":["advisory"],"published_at":"2026-10-26T01:34:23.983354+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:22:53+00:00","detail_url":"/advisories/advisory%3Aeb3f896f-b067-4661-b773-405c87d7728e","group":{"id":"advisory:eb3f896f-b067-4661-b773-405c87d7728e","revision":1,"primary_event_id":73923,"change":"published","superseded_by":[],"changed":{"id":73923,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-fjm5-2v25-22g4","summary":"CGA-fjm5-2v25-22g4","evidence":"osv:CGA-fjm5-2v25-22g4","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fjm5-2v25-22g4","aliases":["CGA-fjm5-2v25-22g4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjm5-2v25-22g4.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCore/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:52:12Z"}]}}],"modified":"2026-10-03T10:32:40.113363443Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:eb3f896f-b067-4661-b773-405c87d7728e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fjm5-2v25-22g4","advisory_id":"eb3f896f-b067-4661-b773-405c87d7728e","event_types":["advisory"],"published_at":"2026-10-26T01:34:23.983354+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:22:53+00:00","detail_url":"/events/73923"},"members":[{"id":73923,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-fjm5-2v25-22g4","summary":"CGA-fjm5-2v25-22g4","evidence":"osv:CGA-fjm5-2v25-22g4","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fjm5-2v25-22g4","aliases":["CGA-fjm5-2v25-22g4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjm5-2v25-22g4.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCore/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:52:12Z"}]}}],"modified":"2026-10-03T10:32:40.113363443Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:eb3f896f-b067-4661-b773-405c87d7728e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fjm5-2v25-22g4","advisory_id":"eb3f896f-b067-4661-b773-405c87d7728e","event_types":["advisory"],"published_at":"2026-10-26T01:34:23.983354+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:22:53+00:00","detail_url":"/events/73923"}]}},{"id":72876,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-cf68-qr6c-gf9h","summary":"CGA-cf68-qr6c-gf9h","evidence":"osv:CGA-cf68-qr6c-gf9h","products":[{"name":{"value":"airflow-core-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cf68-qr6c-gf9h","aliases":["CGA-cf68-qr6c-gf9h"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-core-2","purl":"pkg:apk/chainguard/airflow-core-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf68-qr6c-gf9h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/home/airflow/.local/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T23:42:22Z"}]}}],"modified":"2026-10-03T10:32:38.989555563Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d308152d-5f19-4d4a-9c25-d03e9c62aaf7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cf68-qr6c-gf9h","advisory_id":"d308152d-5f19-4d4a-9c25-d03e9c62aaf7","event_types":["advisory"],"published_at":"2026-10-26T01:24:09.963708+00:00","technologies":["airflow-core-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:08:57+00:00","detail_url":"/advisories/advisory%3Ad308152d-5f19-4d4a-9c25-d03e9c62aaf7","group":{"id":"advisory:d308152d-5f19-4d4a-9c25-d03e9c62aaf7","revision":1,"primary_event_id":73808,"change":"published","superseded_by":[],"changed":{"id":73808,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-cf68-qr6c-gf9h","summary":"CGA-cf68-qr6c-gf9h","evidence":"osv:CGA-cf68-qr6c-gf9h","products":[{"name":{"value":"airflow-core-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cf68-qr6c-gf9h","aliases":["CGA-cf68-qr6c-gf9h"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-core-2","purl":"pkg:apk/chainguard/airflow-core-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf68-qr6c-gf9h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/home/airflow/.local/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T23:42:22Z"}]}}],"modified":"2026-10-03T10:32:38.989555563Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d308152d-5f19-4d4a-9c25-d03e9c62aaf7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cf68-qr6c-gf9h","advisory_id":"d308152d-5f19-4d4a-9c25-d03e9c62aaf7","event_types":["advisory"],"published_at":"2026-10-26T01:24:09.963708+00:00","technologies":["airflow-core-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:08:57+00:00","detail_url":"/events/73808"},"members":[{"id":73808,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-cf68-qr6c-gf9h","summary":"CGA-cf68-qr6c-gf9h","evidence":"osv:CGA-cf68-qr6c-gf9h","products":[{"name":{"value":"airflow-core-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cf68-qr6c-gf9h","aliases":["CGA-cf68-qr6c-gf9h"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-core-2","purl":"pkg:apk/chainguard/airflow-core-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf68-qr6c-gf9h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/home/airflow/.local/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T23:42:22Z"}]}}],"modified":"2026-10-03T10:32:38.989555563Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d308152d-5f19-4d4a-9c25-d03e9c62aaf7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cf68-qr6c-gf9h","advisory_id":"d308152d-5f19-4d4a-9c25-d03e9c62aaf7","event_types":["advisory"],"published_at":"2026-10-26T01:24:09.963708+00:00","technologies":["airflow-core-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:08:57+00:00","detail_url":"/events/73808"}]}},{"id":72871,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-cg6p-4x33-ggqf","summary":"CGA-cg6p-4x33-ggqf","evidence":"osv:CGA-cg6p-4x33-ggqf","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cg6p-4x33-ggqf","aliases":["CGA-cg6p-4x33-ggqf"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cg6p-4x33-ggqf.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCheckUpdates/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:52:12Z"}]}}],"modified":"2026-10-03T10:32:38.555909349Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a1b8d879-8487-4d5d-bc97-29b32316bd04","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cg6p-4x33-ggqf","advisory_id":"a1b8d879-8487-4d5d-bc97-29b32316bd04","event_types":["advisory"],"published_at":"2026-10-26T01:22:39.370765+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:22:47+00:00","detail_url":"/advisories/advisory%3Aa1b8d879-8487-4d5d-bc97-29b32316bd04","group":{"id":"advisory:a1b8d879-8487-4d5d-bc97-29b32316bd04","revision":1,"primary_event_id":73788,"change":"published","superseded_by":[],"changed":{"id":73788,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-cg6p-4x33-ggqf","summary":"CGA-cg6p-4x33-ggqf","evidence":"osv:CGA-cg6p-4x33-ggqf","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cg6p-4x33-ggqf","aliases":["CGA-cg6p-4x33-ggqf"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cg6p-4x33-ggqf.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCheckUpdates/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:52:12Z"}]}}],"modified":"2026-10-03T10:32:38.555909349Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a1b8d879-8487-4d5d-bc97-29b32316bd04","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cg6p-4x33-ggqf","advisory_id":"a1b8d879-8487-4d5d-bc97-29b32316bd04","event_types":["advisory"],"published_at":"2026-10-26T01:22:39.370765+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:22:47+00:00","detail_url":"/events/73788"},"members":[{"id":73788,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-cg6p-4x33-ggqf","summary":"CGA-cg6p-4x33-ggqf","evidence":"osv:CGA-cg6p-4x33-ggqf","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cg6p-4x33-ggqf","aliases":["CGA-cg6p-4x33-ggqf"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cg6p-4x33-ggqf.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCheckUpdates/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:52:12Z"}]}}],"modified":"2026-10-03T10:32:38.555909349Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a1b8d879-8487-4d5d-bc97-29b32316bd04","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cg6p-4x33-ggqf","advisory_id":"a1b8d879-8487-4d5d-bc97-29b32316bd04","event_types":["advisory"],"published_at":"2026-10-26T01:22:39.370765+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:22:47+00:00","detail_url":"/events/73788"}]}},{"id":72862,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-c368-86ff-8cpx","summary":"CGA-c368-86ff-8cpx","evidence":"osv:CGA-c368-86ff-8cpx","products":[{"name":{"value":"wazuh-dashboard-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c368-86ff-8cpx","aliases":["CGA-c368-86ff-8cpx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c368-86ff-8cpx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:15:35Z"}]}}],"modified":"2026-10-03T10:32:38.347536424Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bcdf3c6c-f2a7-4e10-9e0c-0d548c63af7f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c368-86ff-8cpx","advisory_id":"bcdf3c6c-f2a7-4e10-9e0c-0d548c63af7f","event_types":["advisory"],"published_at":"2026-10-26T01:19:47.481228+00:00","technologies":["core-osv","wazuh-dashboard-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:30:04+00:00","detail_url":"/advisories/advisory%3Abcdf3c6c-f2a7-4e10-9e0c-0d548c63af7f","group":{"id":"advisory:bcdf3c6c-f2a7-4e10-9e0c-0d548c63af7f","revision":1,"primary_event_id":73747,"change":"published","superseded_by":[],"changed":{"id":73747,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-c368-86ff-8cpx","summary":"CGA-c368-86ff-8cpx","evidence":"osv:CGA-c368-86ff-8cpx","products":[{"name":{"value":"wazuh-dashboard-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c368-86ff-8cpx","aliases":["CGA-c368-86ff-8cpx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c368-86ff-8cpx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:15:35Z"}]}}],"modified":"2026-10-03T10:32:38.347536424Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bcdf3c6c-f2a7-4e10-9e0c-0d548c63af7f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c368-86ff-8cpx","advisory_id":"bcdf3c6c-f2a7-4e10-9e0c-0d548c63af7f","event_types":["advisory"],"published_at":"2026-10-26T01:19:47.481228+00:00","technologies":["core-osv","wazuh-dashboard-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:30:04+00:00","detail_url":"/events/73747"},"members":[{"id":73747,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-c368-86ff-8cpx","summary":"CGA-c368-86ff-8cpx","evidence":"osv:CGA-c368-86ff-8cpx","products":[{"name":{"value":"wazuh-dashboard-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c368-86ff-8cpx","aliases":["CGA-c368-86ff-8cpx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c368-86ff-8cpx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:15:35Z"}]}}],"modified":"2026-10-03T10:32:38.347536424Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:bcdf3c6c-f2a7-4e10-9e0c-0d548c63af7f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c368-86ff-8cpx","advisory_id":"bcdf3c6c-f2a7-4e10-9e0c-0d548c63af7f","event_types":["advisory"],"published_at":"2026-10-26T01:19:47.481228+00:00","technologies":["core-osv","wazuh-dashboard-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:30:04+00:00","detail_url":"/events/73747"}]}},{"id":72742,"cve_ids":["CVE-2026-101898","CVE-2026-101900","CVE-2026-101901","CVE-2026-101902","CVE-2026-101903","CVE-2026-101904","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101908","CVE-2026-101909"],"payload":{"kind":"advisory","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","evidence":"osv:RHSA-2026:74872","products":[{"name":{"value":"grafana13.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0:13.2.1-0.9.hum1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"RHSA-2026:74872","aliases":["RHSA-2026:74872"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.9.hum1"}]}],"package":{"name":"grafana13.2","purl":"pkg:rpm/redhat/grafana13.2","ecosystem":"Red Hat:hummingbird:1"},"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:74872.json"}}],"modified":"2026-10-03T10:32:34.608460980Z","provider":"osv","upstream":["CVE-2026-101898","CVE-2026-101900","CVE-2026-101901","CVE-2026-101902","CVE-2026-101903","CVE-2026-101904","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101908","CVE-2026-101909"],"references":["https://access.redhat.com/errata/RHSA-2026:74872","https://access.redhat.com/security/cve/CVE-2026-101903","https://access.redhat.com/security/updates/classification/","https://images.redhat.com/","https://access.redhat.com/security/cve/CVE-2026-101905","https://access.redhat.com/security/cve/CVE-2026-101902","https://access.redhat.com/security/cve/CVE-2026-101901","https://access.redhat.com/security/cve/CVE-2026-101904","https://access.redhat.com/security/cve/CVE-2026-101906","https://access.redhat.com/security/cve/CVE-2026-101898","https://access.redhat.com/security/cve/CVE-2026-101907","https://access.redhat.com/security/cve/CVE-2026-101908","https://access.redhat.com/security/cve/CVE-2026-101909","https://access.redhat.com/security/cve/CVE-2026-101900","https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74872.json","https://bugzilla.redhat.com/show_bug.cgi?id=2542571","https://www.cve.org/CVERecord?id=CVE-2026-101898","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://bugzilla.redhat.com/show_bug.cgi?id=2542576","https://www.cve.org/CVERecord?id=CVE-2026-101900","https://nvd.nist.gov/vuln/detail/CVE-2026-101900","https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","https://bugzilla.redhat.com/show_bug.cgi?id=2542577","https://www.cve.org/CVERecord?id=CVE-2026-101901","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://bugzilla.redhat.com/show_bug.cgi?id=2542575","https://www.cve.org/CVERecord?id=CVE-2026-101902","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://bugzilla.redhat.com/show_bug.cgi?id=2542580","https://www.cve.org/CVERecord?id=CVE-2026-101903","https://nvd.nist.gov/vuln/detail/CVE-2026-101903","https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r","https://bugzilla.redhat.com/show_bug.cgi?id=2542579","https://www.cve.org/CVERecord?id=CVE-2026-101904","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://bugzilla.redhat.com/show_bug.cgi?id=2542584","https://www.cve.org/CVERecord?id=CVE-2026-101905","https://nvd.nist.gov/vuln/detail/CVE-2026-101905","https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3","https://bugzilla.redhat.com/show_bug.cgi?id=2542583","https://www.cve.org/CVERecord?id=CVE-2026-101906","https://nvd.nist.gov/vuln/detail/CVE-2026-101906","https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj","https://bugzilla.redhat.com/show_bug.cgi?id=2542586","https://www.cve.org/CVERecord?id=CVE-2026-101907","https://nvd.nist.gov/vuln/detail/CVE-2026-101907","https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh","https://bugzilla.redhat.com/show_bug.cgi?id=2542592","https://www.cve.org/CVERecord?id=CVE-2026-101908","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://bugzilla.redhat.com/show_bug.cgi?id=2542593","https://www.cve.org/CVERecord?id=CVE-2026-101909","https://nvd.nist.gov/vuln/detail/CVE-2026-101909","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f"]},"related_cves":[{"value":"CVE-2026-101898","evidence":"/upstream"},{"value":"CVE-2026-101900","evidence":"/upstream"},{"value":"CVE-2026-101901","evidence":"/upstream"},{"value":"CVE-2026-101902","evidence":"/upstream"},{"value":"CVE-2026-101903","evidence":"/upstream"},{"value":"CVE-2026-101904","evidence":"/upstream"},{"value":"CVE-2026-101905","evidence":"/upstream"},{"value":"CVE-2026-101906","evidence":"/upstream"},{"value":"CVE-2026-101907","evidence":"/upstream"},{"value":"CVE-2026-101908","evidence":"/upstream"},{"value":"CVE-2026-101909","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0ef413e4-8008-4c41-897c-014174f3f269","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101898","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101898","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101898","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101900","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101900","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101903","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101903","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101903","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-c29m-xwm3-cm6r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101904","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101904","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101905","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101905","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101905","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m8m8-qj5v-23w3","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101906","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101906","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101906","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-mghh-pgcx-3jjj","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101907","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101907","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101907","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-r4gj-5m52-g5wh","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101908","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101908","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101909","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101909","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101909","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.34.0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"axios","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-x97p-jq2g-jp4f","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/RHSA-2026%3A74872","advisory_id":"0ef413e4-8008-4c41-897c-014174f3f269","event_types":["advisory"],"published_at":"2026-10-26T00:57:51.165591+00:00","technologies":["core-osv","grafana13-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-03T10:17:01+00:00","detail_url":"/advisories/advisory%3A0ef413e4-8008-4c41-897c-014174f3f269","group":{"id":"advisory:0ef413e4-8008-4c41-897c-014174f3f269","revision":1,"primary_event_id":73507,"change":"published","superseded_by":[],"changed":{"id":73507,"cve_ids":["CVE-2026-101898","CVE-2026-101900","CVE-2026-101901","CVE-2026-101902","CVE-2026-101903","CVE-2026-101904","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101908","CVE-2026-101909"],"payload":{"kind":"advisory","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","evidence":"osv:RHSA-2026:74872","products":[{"name":{"value":"grafana13.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0:13.2.1-0.9.hum1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"RHSA-2026:74872","aliases":["RHSA-2026:74872"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.9.hum1"}]}],"package":{"name":"grafana13.2","purl":"pkg:rpm/redhat/grafana13.2","ecosystem":"Red Hat:hummingbird:1"},"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:74872.json"}}],"modified":"2026-10-03T10:32:34.608460980Z","provider":"osv","upstream":["CVE-2026-101898","CVE-2026-101900","CVE-2026-101901","CVE-2026-101902","CVE-2026-101903","CVE-2026-101904","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101908","CVE-2026-101909"],"references":["https://access.redhat.com/errata/RHSA-2026:74872","https://access.redhat.com/security/cve/CVE-2026-101903","https://access.redhat.com/security/updates/classification/","https://images.redhat.com/","https://access.redhat.com/security/cve/CVE-2026-101905","https://access.redhat.com/security/cve/CVE-2026-101902","https://access.redhat.com/security/cve/CVE-2026-101901","https://access.redhat.com/security/cve/CVE-2026-101904","https://access.redhat.com/security/cve/CVE-2026-101906","https://access.redhat.com/security/cve/CVE-2026-101898","https://access.redhat.com/security/cve/CVE-2026-101907","https://access.redhat.com/security/cve/CVE-2026-101908","https://access.redhat.com/security/cve/CVE-2026-101909","https://access.redhat.com/security/cve/CVE-2026-101900","https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74872.json","https://bugzilla.redhat.com/show_bug.cgi?id=2542571","https://www.cve.org/CVERecord?id=CVE-2026-101898","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://bugzilla.redhat.com/show_bug.cgi?id=2542576","https://www.cve.org/CVERecord?id=CVE-2026-101900","https://nvd.nist.gov/vuln/detail/CVE-2026-101900","https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","https://bugzilla.redhat.com/show_bug.cgi?id=2542577","https://www.cve.org/CVERecord?id=CVE-2026-101901","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://bugzilla.redhat.com/show_bug.cgi?id=2542575","https://www.cve.org/CVERecord?id=CVE-2026-101902","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://bugzilla.redhat.com/show_bug.cgi?id=2542580","https://www.cve.org/CVERecord?id=CVE-2026-101903","https://nvd.nist.gov/vuln/detail/CVE-2026-101903","https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r","https://bugzilla.redhat.com/show_bug.cgi?id=2542579","https://www.cve.org/CVERecord?id=CVE-2026-101904","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://bugzilla.redhat.com/show_bug.cgi?id=2542584","https://www.cve.org/CVERecord?id=CVE-2026-101905","https://nvd.nist.gov/vuln/detail/CVE-2026-101905","https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3","https://bugzilla.redhat.com/show_bug.cgi?id=2542583","https://www.cve.org/CVERecord?id=CVE-2026-101906","https://nvd.nist.gov/vuln/detail/CVE-2026-101906","https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj","https://bugzilla.redhat.com/show_bug.cgi?id=2542586","https://www.cve.org/CVERecord?id=CVE-2026-101907","https://nvd.nist.gov/vuln/detail/CVE-2026-101907","https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh","https://bugzilla.redhat.com/show_bug.cgi?id=2542592","https://www.cve.org/CVERecord?id=CVE-2026-101908","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://bugzilla.redhat.com/show_bug.cgi?id=2542593","https://www.cve.org/CVERecord?id=CVE-2026-101909","https://nvd.nist.gov/vuln/detail/CVE-2026-101909","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f"]},"related_cves":[{"value":"CVE-2026-101898","evidence":"/upstream"},{"value":"CVE-2026-101900","evidence":"/upstream"},{"value":"CVE-2026-101901","evidence":"/upstream"},{"value":"CVE-2026-101902","evidence":"/upstream"},{"value":"CVE-2026-101903","evidence":"/upstream"},{"value":"CVE-2026-101904","evidence":"/upstream"},{"value":"CVE-2026-101905","evidence":"/upstream"},{"value":"CVE-2026-101906","evidence":"/upstream"},{"value":"CVE-2026-101907","evidence":"/upstream"},{"value":"CVE-2026-101908","evidence":"/upstream"},{"value":"CVE-2026-101909","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0ef413e4-8008-4c41-897c-014174f3f269","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101898","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101898","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101898","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101900","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101900","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101903","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101903","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101903","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-c29m-xwm3-cm6r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101904","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101904","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101905","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101905","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101905","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m8m8-qj5v-23w3","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101906","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101906","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101906","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-mghh-pgcx-3jjj","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101907","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101907","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101907","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-r4gj-5m52-g5wh","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101908","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101908","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101909","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101909","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101909","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.34.0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"axios","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-x97p-jq2g-jp4f","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/RHSA-2026%3A74872","advisory_id":"0ef413e4-8008-4c41-897c-014174f3f269","event_types":["advisory"],"published_at":"2026-10-26T00:57:51.165591+00:00","technologies":["core-osv","grafana13-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-03T10:17:01+00:00","detail_url":"/events/73507"},"members":[{"id":73507,"cve_ids":["CVE-2026-101898","CVE-2026-101900","CVE-2026-101901","CVE-2026-101902","CVE-2026-101903","CVE-2026-101904","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101908","CVE-2026-101909"],"payload":{"kind":"advisory","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","evidence":"osv:RHSA-2026:74872","products":[{"name":{"value":"grafana13.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0:13.2.1-0.9.hum1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"RHSA-2026:74872","aliases":["RHSA-2026:74872"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.9.hum1"}]}],"package":{"name":"grafana13.2","purl":"pkg:rpm/redhat/grafana13.2","ecosystem":"Red Hat:hummingbird:1"},"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:74872.json"}}],"modified":"2026-10-03T10:32:34.608460980Z","provider":"osv","upstream":["CVE-2026-101898","CVE-2026-101900","CVE-2026-101901","CVE-2026-101902","CVE-2026-101903","CVE-2026-101904","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101908","CVE-2026-101909"],"references":["https://access.redhat.com/errata/RHSA-2026:74872","https://access.redhat.com/security/cve/CVE-2026-101903","https://access.redhat.com/security/updates/classification/","https://images.redhat.com/","https://access.redhat.com/security/cve/CVE-2026-101905","https://access.redhat.com/security/cve/CVE-2026-101902","https://access.redhat.com/security/cve/CVE-2026-101901","https://access.redhat.com/security/cve/CVE-2026-101904","https://access.redhat.com/security/cve/CVE-2026-101906","https://access.redhat.com/security/cve/CVE-2026-101898","https://access.redhat.com/security/cve/CVE-2026-101907","https://access.redhat.com/security/cve/CVE-2026-101908","https://access.redhat.com/security/cve/CVE-2026-101909","https://access.redhat.com/security/cve/CVE-2026-101900","https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74872.json","https://bugzilla.redhat.com/show_bug.cgi?id=2542571","https://www.cve.org/CVERecord?id=CVE-2026-101898","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://bugzilla.redhat.com/show_bug.cgi?id=2542576","https://www.cve.org/CVERecord?id=CVE-2026-101900","https://nvd.nist.gov/vuln/detail/CVE-2026-101900","https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","https://bugzilla.redhat.com/show_bug.cgi?id=2542577","https://www.cve.org/CVERecord?id=CVE-2026-101901","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://bugzilla.redhat.com/show_bug.cgi?id=2542575","https://www.cve.org/CVERecord?id=CVE-2026-101902","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://bugzilla.redhat.com/show_bug.cgi?id=2542580","https://www.cve.org/CVERecord?id=CVE-2026-101903","https://nvd.nist.gov/vuln/detail/CVE-2026-101903","https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r","https://bugzilla.redhat.com/show_bug.cgi?id=2542579","https://www.cve.org/CVERecord?id=CVE-2026-101904","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://bugzilla.redhat.com/show_bug.cgi?id=2542584","https://www.cve.org/CVERecord?id=CVE-2026-101905","https://nvd.nist.gov/vuln/detail/CVE-2026-101905","https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3","https://bugzilla.redhat.com/show_bug.cgi?id=2542583","https://www.cve.org/CVERecord?id=CVE-2026-101906","https://nvd.nist.gov/vuln/detail/CVE-2026-101906","https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj","https://bugzilla.redhat.com/show_bug.cgi?id=2542586","https://www.cve.org/CVERecord?id=CVE-2026-101907","https://nvd.nist.gov/vuln/detail/CVE-2026-101907","https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh","https://bugzilla.redhat.com/show_bug.cgi?id=2542592","https://www.cve.org/CVERecord?id=CVE-2026-101908","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://bugzilla.redhat.com/show_bug.cgi?id=2542593","https://www.cve.org/CVERecord?id=CVE-2026-101909","https://nvd.nist.gov/vuln/detail/CVE-2026-101909","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f"]},"related_cves":[{"value":"CVE-2026-101898","evidence":"/upstream"},{"value":"CVE-2026-101900","evidence":"/upstream"},{"value":"CVE-2026-101901","evidence":"/upstream"},{"value":"CVE-2026-101902","evidence":"/upstream"},{"value":"CVE-2026-101903","evidence":"/upstream"},{"value":"CVE-2026-101904","evidence":"/upstream"},{"value":"CVE-2026-101905","evidence":"/upstream"},{"value":"CVE-2026-101906","evidence":"/upstream"},{"value":"CVE-2026-101907","evidence":"/upstream"},{"value":"CVE-2026-101908","evidence":"/upstream"},{"value":"CVE-2026-101909","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0ef413e4-8008-4c41-897c-014174f3f269","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101898","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101898","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101898","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101900","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101900","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101903","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101903","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101903","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-c29m-xwm3-cm6r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101904","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101904","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101905","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101905","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101905","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m8m8-qj5v-23w3","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101906","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101906","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101906","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-mghh-pgcx-3jjj","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101907","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101907","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101907","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-r4gj-5m52-g5wh","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101908","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101908","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101909","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101909","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101909","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.34.0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"axios","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-x97p-jq2g-jp4f","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/RHSA-2026%3A74872","advisory_id":"0ef413e4-8008-4c41-897c-014174f3f269","event_types":["advisory"],"published_at":"2026-10-26T00:57:51.165591+00:00","technologies":["core-osv","grafana13-2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-03T10:17:01+00:00","detail_url":"/events/73507"}]}},{"id":72717,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-79hp-rw35-rq87","summary":"CGA-79hp-rw35-rq87","evidence":"osv:CGA-79hp-rw35-rq87","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-79hp-rw35-rq87","aliases":["CGA-79hp-rw35-rq87"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-79hp-rw35-rq87.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCore/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:01:13Z"}]}}],"modified":"2026-10-03T10:32:31.438635644Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:73449cd0-8160-4b46-aa4b-5e397beac25f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-79hp-rw35-rq87","advisory_id":"73449cd0-8160-4b46-aa4b-5e397beac25f","event_types":["advisory"],"published_at":"2026-10-26T00:53:19.401635+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:30:54+00:00","detail_url":"/advisories/advisory%3A73449cd0-8160-4b46-aa4b-5e397beac25f","group":{"id":"advisory:73449cd0-8160-4b46-aa4b-5e397beac25f","revision":1,"primary_event_id":73461,"change":"published","superseded_by":[],"changed":{"id":73461,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-79hp-rw35-rq87","summary":"CGA-79hp-rw35-rq87","evidence":"osv:CGA-79hp-rw35-rq87","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-79hp-rw35-rq87","aliases":["CGA-79hp-rw35-rq87"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-79hp-rw35-rq87.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCore/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:01:13Z"}]}}],"modified":"2026-10-03T10:32:31.438635644Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:73449cd0-8160-4b46-aa4b-5e397beac25f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-79hp-rw35-rq87","advisory_id":"73449cd0-8160-4b46-aa4b-5e397beac25f","event_types":["advisory"],"published_at":"2026-10-26T00:53:19.401635+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:30:54+00:00","detail_url":"/events/73461"},"members":[{"id":73461,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-79hp-rw35-rq87","summary":"CGA-79hp-rw35-rq87","evidence":"osv:CGA-79hp-rw35-rq87","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-79hp-rw35-rq87","aliases":["CGA-79hp-rw35-rq87"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-79hp-rw35-rq87.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCore/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:01:13Z"}]}}],"modified":"2026-10-03T10:32:31.438635644Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:73449cd0-8160-4b46-aa4b-5e397beac25f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-79hp-rw35-rq87","advisory_id":"73449cd0-8160-4b46-aa4b-5e397beac25f","event_types":["advisory"],"published_at":"2026-10-26T00:53:19.401635+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:30:54+00:00","detail_url":"/events/73461"}]}},{"id":72695,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-568w-36g4-vmwp","summary":"CGA-568w-36g4-vmwp","evidence":"osv:CGA-568w-36g4-vmwp","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-568w-36g4-vmwp","aliases":["CGA-568w-36g4-vmwp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-568w-36g4-vmwp.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCheckUpdates/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:01:12Z"}]}}],"modified":"2026-10-03T10:32:28.347732430Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:03e70159-2bfa-4b63-88f4-b9916ba0f726","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-568w-36g4-vmwp","advisory_id":"03e70159-2bfa-4b63-88f4-b9916ba0f726","event_types":["advisory"],"published_at":"2026-10-26T00:49:34.483782+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:30:50+00:00","detail_url":"/advisories/advisory%3A03e70159-2bfa-4b63-88f4-b9916ba0f726","group":{"id":"advisory:03e70159-2bfa-4b63-88f4-b9916ba0f726","revision":1,"primary_event_id":73426,"change":"published","superseded_by":[],"changed":{"id":73426,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-568w-36g4-vmwp","summary":"CGA-568w-36g4-vmwp","evidence":"osv:CGA-568w-36g4-vmwp","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-568w-36g4-vmwp","aliases":["CGA-568w-36g4-vmwp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-568w-36g4-vmwp.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCheckUpdates/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:01:12Z"}]}}],"modified":"2026-10-03T10:32:28.347732430Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:03e70159-2bfa-4b63-88f4-b9916ba0f726","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-568w-36g4-vmwp","advisory_id":"03e70159-2bfa-4b63-88f4-b9916ba0f726","event_types":["advisory"],"published_at":"2026-10-26T00:49:34.483782+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:30:50+00:00","detail_url":"/events/73426"},"members":[{"id":73426,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-568w-36g4-vmwp","summary":"CGA-568w-36g4-vmwp","evidence":"osv:CGA-568w-36g4-vmwp","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-568w-36g4-vmwp","aliases":["CGA-568w-36g4-vmwp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-568w-36g4-vmwp.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuhCheckUpdates/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:01:12Z"}]}}],"modified":"2026-10-03T10:32:28.347732430Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:03e70159-2bfa-4b63-88f4-b9916ba0f726","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-568w-36g4-vmwp","advisory_id":"03e70159-2bfa-4b63-88f4-b9916ba0f726","event_types":["advisory"],"published_at":"2026-10-26T00:49:34.483782+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:30:50+00:00","detail_url":"/events/73426"}]}},{"id":72677,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-52f4-6f62-82rj","summary":"CGA-52f4-6f62-82rj","evidence":"osv:CGA-52f4-6f62-82rj","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-52f4-6f62-82rj","aliases":["CGA-52f4-6f62-82rj"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-52f4-6f62-82rj.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuh/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:01:12Z"}]}}],"modified":"2026-10-03T10:32:27.354267745Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5eb00b69-3441-4055-a539-08191ffd1efe","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-52f4-6f62-82rj","advisory_id":"5eb00b69-3441-4055-a539-08191ffd1efe","event_types":["advisory"],"published_at":"2026-10-26T00:46:19.258233+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:30:47+00:00","detail_url":"/advisories/advisory%3A5eb00b69-3441-4055-a539-08191ffd1efe","group":{"id":"advisory:5eb00b69-3441-4055-a539-08191ffd1efe","revision":1,"primary_event_id":73404,"change":"published","superseded_by":[],"changed":{"id":73404,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-52f4-6f62-82rj","summary":"CGA-52f4-6f62-82rj","evidence":"osv:CGA-52f4-6f62-82rj","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-52f4-6f62-82rj","aliases":["CGA-52f4-6f62-82rj"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-52f4-6f62-82rj.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuh/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:01:12Z"}]}}],"modified":"2026-10-03T10:32:27.354267745Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5eb00b69-3441-4055-a539-08191ffd1efe","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-52f4-6f62-82rj","advisory_id":"5eb00b69-3441-4055-a539-08191ffd1efe","event_types":["advisory"],"published_at":"2026-10-26T00:46:19.258233+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:30:47+00:00","detail_url":"/events/73404"},"members":[{"id":73404,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-52f4-6f62-82rj","summary":"CGA-52f4-6f62-82rj","evidence":"osv:CGA-52f4-6f62-82rj","products":[{"name":{"value":"wazuh-dashboard-plugins-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-52f4-6f62-82rj","aliases":["CGA-52f4-6f62-82rj"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-plugins-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-52f4-6f62-82rj.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/plugins/wazuh/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T03:01:12Z"}]}}],"modified":"2026-10-03T10:32:27.354267745Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5eb00b69-3441-4055-a539-08191ffd1efe","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-52f4-6f62-82rj","advisory_id":"5eb00b69-3441-4055-a539-08191ffd1efe","event_types":["advisory"],"published_at":"2026-10-26T00:46:19.258233+00:00","technologies":["core-osv","wazuh-dashboard-plugins-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:30:47+00:00","detail_url":"/events/73404"}]}},{"id":72628,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-44vw-43w9-7h36","summary":"CGA-44vw-43w9-7h36","evidence":"osv:CGA-44vw-43w9-7h36","products":[{"name":{"value":"wazuh-dashboard-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-44vw-43w9-7h36","aliases":["CGA-44vw-43w9-7h36"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-44vw-43w9-7h36.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:33:42Z"}]}}],"modified":"2026-10-03T10:32:03.938136488Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7b72064d-f4f6-42a0-8642-ebe33f839252","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-44vw-43w9-7h36","advisory_id":"7b72064d-f4f6-42a0-8642-ebe33f839252","event_types":["advisory"],"published_at":"2026-10-26T00:41:05.690064+00:00","technologies":["core-osv","wazuh-dashboard-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:22:30+00:00","detail_url":"/advisories/advisory%3A7b72064d-f4f6-42a0-8642-ebe33f839252","group":{"id":"advisory:7b72064d-f4f6-42a0-8642-ebe33f839252","revision":1,"primary_event_id":73338,"change":"published","superseded_by":[],"changed":{"id":73338,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-44vw-43w9-7h36","summary":"CGA-44vw-43w9-7h36","evidence":"osv:CGA-44vw-43w9-7h36","products":[{"name":{"value":"wazuh-dashboard-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-44vw-43w9-7h36","aliases":["CGA-44vw-43w9-7h36"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-44vw-43w9-7h36.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:33:42Z"}]}}],"modified":"2026-10-03T10:32:03.938136488Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7b72064d-f4f6-42a0-8642-ebe33f839252","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-44vw-43w9-7h36","advisory_id":"7b72064d-f4f6-42a0-8642-ebe33f839252","event_types":["advisory"],"published_at":"2026-10-26T00:41:05.690064+00:00","technologies":["core-osv","wazuh-dashboard-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:22:30+00:00","detail_url":"/events/73338"},"members":[{"id":73338,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-44vw-43w9-7h36","summary":"CGA-44vw-43w9-7h36","evidence":"osv:CGA-44vw-43w9-7h36","products":[{"name":{"value":"wazuh-dashboard-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-44vw-43w9-7h36","aliases":["CGA-44vw-43w9-7h36"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r3"}]}],"package":{"name":"wazuh-dashboard-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-44vw-43w9-7h36.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/wazuh-dashboard/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T02:33:42Z"}]}}],"modified":"2026-10-03T10:32:03.938136488Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7b72064d-f4f6-42a0-8642-ebe33f839252","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-44vw-43w9-7h36","advisory_id":"7b72064d-f4f6-42a0-8642-ebe33f839252","event_types":["advisory"],"published_at":"2026-10-26T00:41:05.690064+00:00","technologies":["core-osv","wazuh-dashboard-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:22:30+00:00","detail_url":"/events/73338"}]}},{"id":72588,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-3f8h-pfvc-vxwh","summary":"CGA-3f8h-pfvc-vxwh","evidence":"osv:CGA-3f8h-pfvc-vxwh","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3f8h-pfvc-vxwh","aliases":["CGA-3f8h-pfvc-vxwh"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3f8h-pfvc-vxwh.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.8.4","component_type":"npm","component_version":"1.8.4","component_location":"/srv/gitlab/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T01:54:09Z"}]}}],"modified":"2026-10-03T10:31:41.918159040Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:da53321f-f229-41a8-90db-50fcedd83b3b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3f8h-pfvc-vxwh","advisory_id":"da53321f-f229-41a8-90db-50fcedd83b3b","event_types":["advisory"],"published_at":"2026-10-26T00:35:23.079359+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:56:47+00:00","detail_url":"/advisories/advisory%3Ada53321f-f229-41a8-90db-50fcedd83b3b","group":{"id":"advisory:da53321f-f229-41a8-90db-50fcedd83b3b","revision":1,"primary_event_id":73270,"change":"published","superseded_by":[],"changed":{"id":73270,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-3f8h-pfvc-vxwh","summary":"CGA-3f8h-pfvc-vxwh","evidence":"osv:CGA-3f8h-pfvc-vxwh","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3f8h-pfvc-vxwh","aliases":["CGA-3f8h-pfvc-vxwh"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3f8h-pfvc-vxwh.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.8.4","component_type":"npm","component_version":"1.8.4","component_location":"/srv/gitlab/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T01:54:09Z"}]}}],"modified":"2026-10-03T10:31:41.918159040Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:da53321f-f229-41a8-90db-50fcedd83b3b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3f8h-pfvc-vxwh","advisory_id":"da53321f-f229-41a8-90db-50fcedd83b3b","event_types":["advisory"],"published_at":"2026-10-26T00:35:23.079359+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:56:47+00:00","detail_url":"/events/73270"},"members":[{"id":73270,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-3f8h-pfvc-vxwh","summary":"CGA-3f8h-pfvc-vxwh","evidence":"osv:CGA-3f8h-pfvc-vxwh","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3f8h-pfvc-vxwh","aliases":["CGA-3f8h-pfvc-vxwh"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3f8h-pfvc-vxwh.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.8.4","component_type":"npm","component_version":"1.8.4","component_location":"/srv/gitlab/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T01:54:09Z"}]}}],"modified":"2026-10-03T10:31:41.918159040Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:da53321f-f229-41a8-90db-50fcedd83b3b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3f8h-pfvc-vxwh","advisory_id":"da53321f-f229-41a8-90db-50fcedd83b3b","event_types":["advisory"],"published_at":"2026-10-26T00:35:23.079359+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:56:47+00:00","detail_url":"/events/73270"}]}},{"id":72545,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-2x47-2pr8-rfqx","summary":"CGA-2x47-2pr8-rfqx","evidence":"osv:CGA-2x47-2pr8-rfqx","products":[{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2x47-2pr8-rfqx","aliases":["CGA-2x47-2pr8-rfqx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/chainguard/opensearch-dashboards-3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2x47-2pr8-rfqx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:10:28Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/wolfi/opensearch-dashboards-3?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2x47-2pr8-rfqx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:10:28Z"}]}}],"modified":"2026-10-03T10:31:24.187225447Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:beba3006-b91a-4704-875b-8e64cb5d7813","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2x47-2pr8-rfqx","advisory_id":"beba3006-b91a-4704-875b-8e64cb5d7813","event_types":["advisory"],"published_at":"2026-10-26T00:31:03.993671+00:00","technologies":["core-osv","opensearch-dashboards-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:20:13+00:00","detail_url":"/advisories/advisory%3Abeba3006-b91a-4704-875b-8e64cb5d7813","group":{"id":"advisory:beba3006-b91a-4704-875b-8e64cb5d7813","revision":1,"primary_event_id":73219,"change":"published","superseded_by":[],"changed":{"id":73219,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-2x47-2pr8-rfqx","summary":"CGA-2x47-2pr8-rfqx","evidence":"osv:CGA-2x47-2pr8-rfqx","products":[{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2x47-2pr8-rfqx","aliases":["CGA-2x47-2pr8-rfqx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/chainguard/opensearch-dashboards-3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2x47-2pr8-rfqx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:10:28Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/wolfi/opensearch-dashboards-3?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2x47-2pr8-rfqx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:10:28Z"}]}}],"modified":"2026-10-03T10:31:24.187225447Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:beba3006-b91a-4704-875b-8e64cb5d7813","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2x47-2pr8-rfqx","advisory_id":"beba3006-b91a-4704-875b-8e64cb5d7813","event_types":["advisory"],"published_at":"2026-10-26T00:31:03.993671+00:00","technologies":["core-osv","opensearch-dashboards-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:20:13+00:00","detail_url":"/events/73219"},"members":[{"id":73219,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-2x47-2pr8-rfqx","summary":"CGA-2x47-2pr8-rfqx","evidence":"osv:CGA-2x47-2pr8-rfqx","products":[{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"opensearch-dashboards-3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r8","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2x47-2pr8-rfqx","aliases":["CGA-2x47-2pr8-rfqx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/chainguard/opensearch-dashboards-3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2x47-2pr8-rfqx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:10:28Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r8"}]}],"package":{"name":"opensearch-dashboards-3","purl":"pkg:apk/wolfi/opensearch-dashboards-3?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2x47-2pr8-rfqx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-03T01:10:28Z"}]}}],"modified":"2026-10-03T10:31:24.187225447Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:beba3006-b91a-4704-875b-8e64cb5d7813","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2x47-2pr8-rfqx","advisory_id":"beba3006-b91a-4704-875b-8e64cb5d7813","event_types":["advisory"],"published_at":"2026-10-26T00:31:03.993671+00:00","technologies":["core-osv","opensearch-dashboards-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:20:13+00:00","detail_url":"/events/73219"}]}},{"id":72494,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-2g62-gq4r-mf23","summary":"CGA-2g62-gq4r-mf23","evidence":"osv:CGA-2g62-gq4r-mf23","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2g62-gq4r-mf23","aliases":["CGA-2g62-gq4r-mf23"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2g62-gq4r-mf23.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.10.0","component_type":"npm","component_version":"1.10.0","component_location":"/srv/gitlab/storybook/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T01:54:08Z"}]}}],"modified":"2026-10-03T10:30:15.431756045Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1a95ac52-e17a-43e7-9a7c-0e07db3485d3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2g62-gq4r-mf23","advisory_id":"1a95ac52-e17a-43e7-9a7c-0e07db3485d3","event_types":["advisory"],"published_at":"2026-10-26T00:24:29.248778+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:56:46+00:00","detail_url":"/advisories/advisory%3A1a95ac52-e17a-43e7-9a7c-0e07db3485d3","group":{"id":"advisory:1a95ac52-e17a-43e7-9a7c-0e07db3485d3","revision":1,"primary_event_id":73142,"change":"published","superseded_by":[],"changed":{"id":73142,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-2g62-gq4r-mf23","summary":"CGA-2g62-gq4r-mf23","evidence":"osv:CGA-2g62-gq4r-mf23","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2g62-gq4r-mf23","aliases":["CGA-2g62-gq4r-mf23"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2g62-gq4r-mf23.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.10.0","component_type":"npm","component_version":"1.10.0","component_location":"/srv/gitlab/storybook/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T01:54:08Z"}]}}],"modified":"2026-10-03T10:30:15.431756045Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1a95ac52-e17a-43e7-9a7c-0e07db3485d3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2g62-gq4r-mf23","advisory_id":"1a95ac52-e17a-43e7-9a7c-0e07db3485d3","event_types":["advisory"],"published_at":"2026-10-26T00:24:29.248778+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:56:46+00:00","detail_url":"/events/73142"},"members":[{"id":73142,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-2g62-gq4r-mf23","summary":"CGA-2g62-gq4r-mf23","evidence":"osv:CGA-2g62-gq4r-mf23","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2g62-gq4r-mf23","aliases":["CGA-2g62-gq4r-mf23"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2g62-gq4r-mf23.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.10.0","component_type":"npm","component_version":"1.10.0","component_location":"/srv/gitlab/storybook/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-03T01:54:08Z"}]}}],"modified":"2026-10-03T10:30:15.431756045Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1a95ac52-e17a-43e7-9a7c-0e07db3485d3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2g62-gq4r-mf23","advisory_id":"1a95ac52-e17a-43e7-9a7c-0e07db3485d3","event_types":["advisory"],"published_at":"2026-10-26T00:24:29.248778+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:56:46+00:00","detail_url":"/events/73142"}]}},{"id":72112,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-qvv9-9mx9-58xc","summary":"CGA-qvv9-9mx9-58xc","evidence":"osv:CGA-qvv9-9mx9-58xc","products":[{"name":{"value":"kibana-8.19-bitnami","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qvv9-9mx9-58xc","aliases":["CGA-qvv9-9mx9-58xc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19-bitnami","purl":"pkg:apk/chainguard/kibana-8.19-bitnami?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qvv9-9mx9-58xc.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/opt/bitnami/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:45:28Z"}]}}],"modified":"2026-10-02T23:12:53.727780676Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fa0736a9-f9cb-4db0-85ea-9a469b213e07","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qvv9-9mx9-58xc","advisory_id":"fa0736a9-f9cb-4db0-85ea-9a469b213e07","event_types":["advisory"],"published_at":"2026-10-26T00:17:02.409077+00:00","technologies":["core-osv","kibana-8-19-bitnami"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:42:14+00:00","detail_url":"/advisories/advisory%3Afa0736a9-f9cb-4db0-85ea-9a469b213e07","group":{"id":"advisory:fa0736a9-f9cb-4db0-85ea-9a469b213e07","revision":1,"primary_event_id":72743,"change":"published","superseded_by":[],"changed":{"id":72743,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-qvv9-9mx9-58xc","summary":"CGA-qvv9-9mx9-58xc","evidence":"osv:CGA-qvv9-9mx9-58xc","products":[{"name":{"value":"kibana-8.19-bitnami","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qvv9-9mx9-58xc","aliases":["CGA-qvv9-9mx9-58xc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19-bitnami","purl":"pkg:apk/chainguard/kibana-8.19-bitnami?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qvv9-9mx9-58xc.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/opt/bitnami/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:45:28Z"}]}}],"modified":"2026-10-02T23:12:53.727780676Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fa0736a9-f9cb-4db0-85ea-9a469b213e07","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qvv9-9mx9-58xc","advisory_id":"fa0736a9-f9cb-4db0-85ea-9a469b213e07","event_types":["advisory"],"published_at":"2026-10-26T00:17:02.409077+00:00","technologies":["core-osv","kibana-8-19-bitnami"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:42:14+00:00","detail_url":"/events/72743"},"members":[{"id":72743,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-qvv9-9mx9-58xc","summary":"CGA-qvv9-9mx9-58xc","evidence":"osv:CGA-qvv9-9mx9-58xc","products":[{"name":{"value":"kibana-8.19-bitnami","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qvv9-9mx9-58xc","aliases":["CGA-qvv9-9mx9-58xc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19-bitnami","purl":"pkg:apk/chainguard/kibana-8.19-bitnami?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qvv9-9mx9-58xc.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/opt/bitnami/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:45:28Z"}]}}],"modified":"2026-10-02T23:12:53.727780676Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fa0736a9-f9cb-4db0-85ea-9a469b213e07","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qvv9-9mx9-58xc","advisory_id":"fa0736a9-f9cb-4db0-85ea-9a469b213e07","event_types":["advisory"],"published_at":"2026-10-26T00:17:02.409077+00:00","technologies":["core-osv","kibana-8-19-bitnami"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:42:14+00:00","detail_url":"/events/72743"}]}},{"id":72107,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-qphp-gw89-r7gw","summary":"CGA-qphp-gw89-r7gw","evidence":"osv:CGA-qphp-gw89-r7gw","products":[{"name":{"value":"kibana-8.19-bitnami","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qphp-gw89-r7gw","aliases":["CGA-qphp-gw89-r7gw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19-bitnami","purl":"pkg:apk/chainguard/kibana-8.19-bitnami?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qphp-gw89-r7gw.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/opt/bitnami/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:04:10Z"}]}}],"modified":"2026-10-02T23:12:53.403173749Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ed8a2553-27dd-4cf7-83c2-e11d7a0052c7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qphp-gw89-r7gw","advisory_id":"ed8a2553-27dd-4cf7-83c2-e11d7a0052c7","event_types":["advisory"],"published_at":"2026-10-26T00:16:57.884151+00:00","technologies":["core-osv","kibana-8-19-bitnami"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:23:14+00:00","detail_url":"/advisories/advisory%3Aed8a2553-27dd-4cf7-83c2-e11d7a0052c7","group":{"id":"advisory:ed8a2553-27dd-4cf7-83c2-e11d7a0052c7","revision":1,"primary_event_id":72738,"change":"published","superseded_by":[],"changed":{"id":72738,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-qphp-gw89-r7gw","summary":"CGA-qphp-gw89-r7gw","evidence":"osv:CGA-qphp-gw89-r7gw","products":[{"name":{"value":"kibana-8.19-bitnami","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qphp-gw89-r7gw","aliases":["CGA-qphp-gw89-r7gw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19-bitnami","purl":"pkg:apk/chainguard/kibana-8.19-bitnami?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qphp-gw89-r7gw.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/opt/bitnami/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:04:10Z"}]}}],"modified":"2026-10-02T23:12:53.403173749Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ed8a2553-27dd-4cf7-83c2-e11d7a0052c7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qphp-gw89-r7gw","advisory_id":"ed8a2553-27dd-4cf7-83c2-e11d7a0052c7","event_types":["advisory"],"published_at":"2026-10-26T00:16:57.884151+00:00","technologies":["core-osv","kibana-8-19-bitnami"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:23:14+00:00","detail_url":"/events/72738"},"members":[{"id":72738,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-qphp-gw89-r7gw","summary":"CGA-qphp-gw89-r7gw","evidence":"osv:CGA-qphp-gw89-r7gw","products":[{"name":{"value":"kibana-8.19-bitnami","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qphp-gw89-r7gw","aliases":["CGA-qphp-gw89-r7gw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19-bitnami","purl":"pkg:apk/chainguard/kibana-8.19-bitnami?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qphp-gw89-r7gw.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/opt/bitnami/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:04:10Z"}]}}],"modified":"2026-10-02T23:12:53.403173749Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ed8a2553-27dd-4cf7-83c2-e11d7a0052c7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qphp-gw89-r7gw","advisory_id":"ed8a2553-27dd-4cf7-83c2-e11d7a0052c7","event_types":["advisory"],"published_at":"2026-10-26T00:16:57.884151+00:00","technologies":["core-osv","kibana-8-19-bitnami"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:23:14+00:00","detail_url":"/events/72738"}]}},{"id":72086,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-92w6-38x3-pwxw","summary":"CGA-92w6-38x3-pwxw","evidence":"osv:CGA-92w6-38x3-pwxw","products":[{"name":{"value":"kibana-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-92w6-38x3-pwxw","aliases":["CGA-92w6-38x3-pwxw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19","purl":"pkg:apk/chainguard/kibana-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-92w6-38x3-pwxw.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/usr/share/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:00:11Z"}]}}],"modified":"2026-10-02T23:12:51.104037884Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a17c126f-f160-451e-ae42-cbb53835dad3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-92w6-38x3-pwxw","advisory_id":"a17c126f-f160-451e-ae42-cbb53835dad3","event_types":["advisory"],"published_at":"2026-10-26T00:16:29.512139+00:00","technologies":["core-osv","kibana-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:35:18+00:00","detail_url":"/advisories/advisory%3Aa17c126f-f160-451e-ae42-cbb53835dad3","group":{"id":"advisory:a17c126f-f160-451e-ae42-cbb53835dad3","revision":1,"primary_event_id":72717,"change":"published","superseded_by":[],"changed":{"id":72717,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-92w6-38x3-pwxw","summary":"CGA-92w6-38x3-pwxw","evidence":"osv:CGA-92w6-38x3-pwxw","products":[{"name":{"value":"kibana-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-92w6-38x3-pwxw","aliases":["CGA-92w6-38x3-pwxw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19","purl":"pkg:apk/chainguard/kibana-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-92w6-38x3-pwxw.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/usr/share/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:00:11Z"}]}}],"modified":"2026-10-02T23:12:51.104037884Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a17c126f-f160-451e-ae42-cbb53835dad3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-92w6-38x3-pwxw","advisory_id":"a17c126f-f160-451e-ae42-cbb53835dad3","event_types":["advisory"],"published_at":"2026-10-26T00:16:29.512139+00:00","technologies":["core-osv","kibana-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:35:18+00:00","detail_url":"/events/72717"},"members":[{"id":72717,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-92w6-38x3-pwxw","summary":"CGA-92w6-38x3-pwxw","evidence":"osv:CGA-92w6-38x3-pwxw","products":[{"name":{"value":"kibana-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-92w6-38x3-pwxw","aliases":["CGA-92w6-38x3-pwxw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19","purl":"pkg:apk/chainguard/kibana-8.19?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-92w6-38x3-pwxw.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/usr/share/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:00:11Z"}]}}],"modified":"2026-10-02T23:12:51.104037884Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a17c126f-f160-451e-ae42-cbb53835dad3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-92w6-38x3-pwxw","advisory_id":"a17c126f-f160-451e-ae42-cbb53835dad3","event_types":["advisory"],"published_at":"2026-10-26T00:16:29.512139+00:00","technologies":["core-osv","kibana-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:35:18+00:00","detail_url":"/events/72717"}]}},{"id":71933,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-pwrp-hvw3-qg57","summary":"CGA-pwrp-hvw3-qg57","evidence":"osv:CGA-pwrp-hvw3-qg57","products":[{"name":{"value":"kibana-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-pwrp-hvw3-qg57","aliases":["CGA-pwrp-hvw3-qg57"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19","purl":"pkg:apk/chainguard/kibana-8.19?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pwrp-hvw3-qg57.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/usr/share/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:56:09Z"}]}}],"modified":"2026-10-02T23:01:42.659524344Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f3dd17ed-c6ea-49be-93f4-b9c2f64b973b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pwrp-hvw3-qg57","advisory_id":"f3dd17ed-c6ea-49be-93f4-b9c2f64b973b","event_types":["advisory"],"published_at":"2026-10-25T23:56:51.076249+00:00","technologies":["core-osv","kibana-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:33:48+00:00","detail_url":"/advisories/advisory%3Af3dd17ed-c6ea-49be-93f4-b9c2f64b973b","group":{"id":"advisory:f3dd17ed-c6ea-49be-93f4-b9c2f64b973b","revision":1,"primary_event_id":72477,"change":"published","superseded_by":[],"changed":{"id":72477,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-pwrp-hvw3-qg57","summary":"CGA-pwrp-hvw3-qg57","evidence":"osv:CGA-pwrp-hvw3-qg57","products":[{"name":{"value":"kibana-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-pwrp-hvw3-qg57","aliases":["CGA-pwrp-hvw3-qg57"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19","purl":"pkg:apk/chainguard/kibana-8.19?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pwrp-hvw3-qg57.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/usr/share/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:56:09Z"}]}}],"modified":"2026-10-02T23:01:42.659524344Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f3dd17ed-c6ea-49be-93f4-b9c2f64b973b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pwrp-hvw3-qg57","advisory_id":"f3dd17ed-c6ea-49be-93f4-b9c2f64b973b","event_types":["advisory"],"published_at":"2026-10-25T23:56:51.076249+00:00","technologies":["core-osv","kibana-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:33:48+00:00","detail_url":"/events/72477"},"members":[{"id":72477,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-pwrp-hvw3-qg57","summary":"CGA-pwrp-hvw3-qg57","evidence":"osv:CGA-pwrp-hvw3-qg57","products":[{"name":{"value":"kibana-8.19","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-pwrp-hvw3-qg57","aliases":["CGA-pwrp-hvw3-qg57"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r4"}]}],"package":{"name":"kibana-8.19","purl":"pkg:apk/chainguard/kibana-8.19?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pwrp-hvw3-qg57.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.19.0","component_type":"npm","component_version":"1.19.0","component_location":"/usr/share/kibana/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:56:09Z"}]}}],"modified":"2026-10-02T23:01:42.659524344Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f3dd17ed-c6ea-49be-93f4-b9c2f64b973b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pwrp-hvw3-qg57","advisory_id":"f3dd17ed-c6ea-49be-93f4-b9c2f64b973b","event_types":["advisory"],"published_at":"2026-10-25T23:56:51.076249+00:00","technologies":["core-osv","kibana-8-19"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:33:48+00:00","detail_url":"/events/72477"}]}},{"id":71493,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-wgv5-6qx3-5jwp","summary":"CGA-wgv5-6qx3-5jwp","evidence":"osv:CGA-wgv5-6qx3-5jwp","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wgv5-6qx3-5jwp","aliases":["CGA-wgv5-6qx3-5jwp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wgv5-6qx3-5jwp.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:59.192902791Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d36a79bb-7ff4-417f-ab46-ad60d22a200a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wgv5-6qx3-5jwp","advisory_id":"d36a79bb-7ff4-417f-ab46-ad60d22a200a","event_types":["advisory"],"published_at":"2026-10-25T23:14:19.440198+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:37+00:00","detail_url":"/advisories/advisory%3Ad36a79bb-7ff4-417f-ab46-ad60d22a200a","group":{"id":"advisory:d36a79bb-7ff4-417f-ab46-ad60d22a200a","revision":1,"primary_event_id":71900,"change":"published","superseded_by":[],"changed":{"id":71900,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-wgv5-6qx3-5jwp","summary":"CGA-wgv5-6qx3-5jwp","evidence":"osv:CGA-wgv5-6qx3-5jwp","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wgv5-6qx3-5jwp","aliases":["CGA-wgv5-6qx3-5jwp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wgv5-6qx3-5jwp.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:59.192902791Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d36a79bb-7ff4-417f-ab46-ad60d22a200a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wgv5-6qx3-5jwp","advisory_id":"d36a79bb-7ff4-417f-ab46-ad60d22a200a","event_types":["advisory"],"published_at":"2026-10-25T23:14:19.440198+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:37+00:00","detail_url":"/events/71900"},"members":[{"id":71900,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-wgv5-6qx3-5jwp","summary":"CGA-wgv5-6qx3-5jwp","evidence":"osv:CGA-wgv5-6qx3-5jwp","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wgv5-6qx3-5jwp","aliases":["CGA-wgv5-6qx3-5jwp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wgv5-6qx3-5jwp.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:59.192902791Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d36a79bb-7ff4-417f-ab46-ad60d22a200a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wgv5-6qx3-5jwp","advisory_id":"d36a79bb-7ff4-417f-ab46-ad60d22a200a","event_types":["advisory"],"published_at":"2026-10-25T23:14:19.440198+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:37+00:00","detail_url":"/events/71900"}]}},{"id":70954,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-vghx-ggvv-cgg8","summary":"CGA-vghx-ggvv-cgg8","evidence":"osv:CGA-vghx-ggvv-cgg8","products":[{"name":{"value":"opensearch-dashboards-3-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vghx-ggvv-cgg8","aliases":["CGA-vghx-ggvv-cgg8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r5"}]}],"package":{"name":"opensearch-dashboards-3-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-3-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vghx-ggvv-cgg8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:49:09Z"}]}}],"modified":"2026-10-02T18:28:03.779345881Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a01237d5-de8d-41cf-8de2-e31cfd4462d9","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vghx-ggvv-cgg8","advisory_id":"a01237d5-de8d-41cf-8de2-e31cfd4462d9","event_types":["advisory"],"published_at":"2026-10-25T22:45:28.549607+00:00","technologies":["core-osv","opensearch-dashboards-3-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T03:15:29+00:00","detail_url":"/advisories/advisory%3Aa01237d5-de8d-41cf-8de2-e31cfd4462d9","group":{"id":"advisory:a01237d5-de8d-41cf-8de2-e31cfd4462d9","revision":1,"primary_event_id":71325,"change":"published","superseded_by":[],"changed":{"id":71325,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-vghx-ggvv-cgg8","summary":"CGA-vghx-ggvv-cgg8","evidence":"osv:CGA-vghx-ggvv-cgg8","products":[{"name":{"value":"opensearch-dashboards-3-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vghx-ggvv-cgg8","aliases":["CGA-vghx-ggvv-cgg8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r5"}]}],"package":{"name":"opensearch-dashboards-3-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-3-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vghx-ggvv-cgg8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:49:09Z"}]}}],"modified":"2026-10-02T18:28:03.779345881Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a01237d5-de8d-41cf-8de2-e31cfd4462d9","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vghx-ggvv-cgg8","advisory_id":"a01237d5-de8d-41cf-8de2-e31cfd4462d9","event_types":["advisory"],"published_at":"2026-10-25T22:45:28.549607+00:00","technologies":["core-osv","opensearch-dashboards-3-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T03:15:29+00:00","detail_url":"/events/71325"},"members":[{"id":71325,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-vghx-ggvv-cgg8","summary":"CGA-vghx-ggvv-cgg8","evidence":"osv:CGA-vghx-ggvv-cgg8","products":[{"name":{"value":"opensearch-dashboards-3-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vghx-ggvv-cgg8","aliases":["CGA-vghx-ggvv-cgg8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r5"}]}],"package":{"name":"opensearch-dashboards-3-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-3-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vghx-ggvv-cgg8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:49:09Z"}]}}],"modified":"2026-10-02T18:28:03.779345881Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a01237d5-de8d-41cf-8de2-e31cfd4462d9","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vghx-ggvv-cgg8","advisory_id":"a01237d5-de8d-41cf-8de2-e31cfd4462d9","event_types":["advisory"],"published_at":"2026-10-25T22:45:28.549607+00:00","technologies":["core-osv","opensearch-dashboards-3-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T03:15:29+00:00","detail_url":"/events/71325"}]}},{"id":70888,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-jmfg-p76w-ch78","summary":"CGA-jmfg-p76w-ch78","evidence":"osv:CGA-jmfg-p76w-ch78","products":[{"name":{"value":"opensearch-dashboards-3-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jmfg-p76w-ch78","aliases":["CGA-jmfg-p76w-ch78"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r5"}]}],"package":{"name":"opensearch-dashboards-3-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-3-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jmfg-p76w-ch78.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:08:58Z"}]}}],"modified":"2026-10-02T18:27:49.050716692Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3c1abc53-5211-4e7d-8245-a31087f44bc7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jmfg-p76w-ch78","advisory_id":"3c1abc53-5211-4e7d-8245-a31087f44bc7","event_types":["advisory"],"published_at":"2026-10-25T22:44:02.481752+00:00","technologies":["core-osv","opensearch-dashboards-3-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:50:12+00:00","detail_url":"/advisories/advisory%3A3c1abc53-5211-4e7d-8245-a31087f44bc7","group":{"id":"advisory:3c1abc53-5211-4e7d-8245-a31087f44bc7","revision":1,"primary_event_id":71259,"change":"published","superseded_by":[],"changed":{"id":71259,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-jmfg-p76w-ch78","summary":"CGA-jmfg-p76w-ch78","evidence":"osv:CGA-jmfg-p76w-ch78","products":[{"name":{"value":"opensearch-dashboards-3-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jmfg-p76w-ch78","aliases":["CGA-jmfg-p76w-ch78"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r5"}]}],"package":{"name":"opensearch-dashboards-3-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-3-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jmfg-p76w-ch78.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:08:58Z"}]}}],"modified":"2026-10-02T18:27:49.050716692Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3c1abc53-5211-4e7d-8245-a31087f44bc7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jmfg-p76w-ch78","advisory_id":"3c1abc53-5211-4e7d-8245-a31087f44bc7","event_types":["advisory"],"published_at":"2026-10-25T22:44:02.481752+00:00","technologies":["core-osv","opensearch-dashboards-3-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:50:12+00:00","detail_url":"/events/71259"},"members":[{"id":71259,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-jmfg-p76w-ch78","summary":"CGA-jmfg-p76w-ch78","evidence":"osv:CGA-jmfg-p76w-ch78","products":[{"name":{"value":"opensearch-dashboards-3-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.8.0-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jmfg-p76w-ch78","aliases":["CGA-jmfg-p76w-ch78"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-r5"}]}],"package":{"name":"opensearch-dashboards-3-fips","purl":"pkg:apk/chainguard/opensearch-dashboards-3-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jmfg-p76w-ch78.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/opensearch-dashboards/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:08:58Z"}]}}],"modified":"2026-10-02T18:27:49.050716692Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3c1abc53-5211-4e7d-8245-a31087f44bc7","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jmfg-p76w-ch78","advisory_id":"3c1abc53-5211-4e7d-8245-a31087f44bc7","event_types":["advisory"],"published_at":"2026-10-25T22:44:02.481752+00:00","technologies":["core-osv","opensearch-dashboards-3-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T04:50:12+00:00","detail_url":"/events/71259"}]}},{"id":70756,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-r2vf-4g49-xxpr","summary":"CGA-r2vf-4g49-xxpr","evidence":"osv:CGA-r2vf-4g49-xxpr","products":[{"name":{"value":"azurite","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.37.0-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r2vf-4g49-xxpr","aliases":["CGA-r2vf-4g49-xxpr"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.0-r4"}]}],"package":{"name":"azurite","purl":"pkg:apk/chainguard/azurite?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r2vf-4g49-xxpr.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@0.33.0","component_type":"npm","component_version":"0.33.0","component_location":"/usr/share/azurite/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T08:53:46Z"}]}}],"modified":"2026-10-02T18:25:44.773509366Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:63965d14-0efc-4b78-bfa3-dcf0d00ab61d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r2vf-4g49-xxpr","advisory_id":"63965d14-0efc-4b78-bfa3-dcf0d00ab61d","event_types":["advisory"],"published_at":"2026-10-25T22:37:53.349847+00:00","technologies":["azurite","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:12:51+00:00","detail_url":"/advisories/advisory%3A63965d14-0efc-4b78-bfa3-dcf0d00ab61d","group":{"id":"advisory:63965d14-0efc-4b78-bfa3-dcf0d00ab61d","revision":1,"primary_event_id":71127,"change":"published","superseded_by":[],"changed":{"id":71127,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-r2vf-4g49-xxpr","summary":"CGA-r2vf-4g49-xxpr","evidence":"osv:CGA-r2vf-4g49-xxpr","products":[{"name":{"value":"azurite","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.37.0-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r2vf-4g49-xxpr","aliases":["CGA-r2vf-4g49-xxpr"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.0-r4"}]}],"package":{"name":"azurite","purl":"pkg:apk/chainguard/azurite?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r2vf-4g49-xxpr.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@0.33.0","component_type":"npm","component_version":"0.33.0","component_location":"/usr/share/azurite/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T08:53:46Z"}]}}],"modified":"2026-10-02T18:25:44.773509366Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:63965d14-0efc-4b78-bfa3-dcf0d00ab61d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r2vf-4g49-xxpr","advisory_id":"63965d14-0efc-4b78-bfa3-dcf0d00ab61d","event_types":["advisory"],"published_at":"2026-10-25T22:37:53.349847+00:00","technologies":["azurite","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:12:51+00:00","detail_url":"/events/71127"},"members":[{"id":71127,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-r2vf-4g49-xxpr","summary":"CGA-r2vf-4g49-xxpr","evidence":"osv:CGA-r2vf-4g49-xxpr","products":[{"name":{"value":"azurite","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.37.0-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-r2vf-4g49-xxpr","aliases":["CGA-r2vf-4g49-xxpr"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.37.0-r4"}]}],"package":{"name":"azurite","purl":"pkg:apk/chainguard/azurite?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r2vf-4g49-xxpr.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@0.33.0","component_type":"npm","component_version":"0.33.0","component_location":"/usr/share/azurite/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T08:53:46Z"}]}}],"modified":"2026-10-02T18:25:44.773509366Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:63965d14-0efc-4b78-bfa3-dcf0d00ab61d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r2vf-4g49-xxpr","advisory_id":"63965d14-0efc-4b78-bfa3-dcf0d00ab61d","event_types":["advisory"],"published_at":"2026-10-25T22:37:53.349847+00:00","technologies":["azurite","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:12:51+00:00","detail_url":"/events/71127"}]}},{"id":70660,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-j7g8-rq4c-gw3w","summary":"CGA-j7g8-rq4c-gw3w","evidence":"osv:CGA-j7g8-rq4c-gw3w","products":[{"name":{"value":"langfuse-fips-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j7g8-rq4c-gw3w","aliases":["CGA-j7g8-rq4c-gw3w"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4","purl":"pkg:apk/chainguard/langfuse-fips-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j7g8-rq4c-gw3w.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:12:24Z"}]}}],"modified":"2026-10-02T18:25:40.307075836Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4de9bba7-6316-403f-84b5-f93314ac9dab","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j7g8-rq4c-gw3w","advisory_id":"4de9bba7-6316-403f-84b5-f93314ac9dab","event_types":["advisory"],"published_at":"2026-10-25T22:33:51.397324+00:00","technologies":["core-osv","langfuse-fips-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:00:30+00:00","detail_url":"/advisories/advisory%3A4de9bba7-6316-403f-84b5-f93314ac9dab","group":{"id":"advisory:4de9bba7-6316-403f-84b5-f93314ac9dab","revision":1,"primary_event_id":71031,"change":"published","superseded_by":[],"changed":{"id":71031,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-j7g8-rq4c-gw3w","summary":"CGA-j7g8-rq4c-gw3w","evidence":"osv:CGA-j7g8-rq4c-gw3w","products":[{"name":{"value":"langfuse-fips-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j7g8-rq4c-gw3w","aliases":["CGA-j7g8-rq4c-gw3w"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4","purl":"pkg:apk/chainguard/langfuse-fips-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j7g8-rq4c-gw3w.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:12:24Z"}]}}],"modified":"2026-10-02T18:25:40.307075836Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4de9bba7-6316-403f-84b5-f93314ac9dab","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j7g8-rq4c-gw3w","advisory_id":"4de9bba7-6316-403f-84b5-f93314ac9dab","event_types":["advisory"],"published_at":"2026-10-25T22:33:51.397324+00:00","technologies":["core-osv","langfuse-fips-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:00:30+00:00","detail_url":"/events/71031"},"members":[{"id":71031,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-j7g8-rq4c-gw3w","summary":"CGA-j7g8-rq4c-gw3w","evidence":"osv:CGA-j7g8-rq4c-gw3w","products":[{"name":{"value":"langfuse-fips-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j7g8-rq4c-gw3w","aliases":["CGA-j7g8-rq4c-gw3w"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4","purl":"pkg:apk/chainguard/langfuse-fips-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j7g8-rq4c-gw3w.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:12:24Z"}]}}],"modified":"2026-10-02T18:25:40.307075836Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4de9bba7-6316-403f-84b5-f93314ac9dab","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j7g8-rq4c-gw3w","advisory_id":"4de9bba7-6316-403f-84b5-f93314ac9dab","event_types":["advisory"],"published_at":"2026-10-25T22:33:51.397324+00:00","technologies":["core-osv","langfuse-fips-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:00:30+00:00","detail_url":"/events/71031"}]}},{"id":70440,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-vgvx-44cw-r5w8","summary":"CGA-vgvx-44cw-r5w8","evidence":"osv:CGA-vgvx-44cw-r5w8","products":[{"name":{"value":"langfuse-fips-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vgvx-44cw-r5w8","aliases":["CGA-vgvx-44cw-r5w8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4","purl":"pkg:apk/chainguard/langfuse-fips-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgvx-44cw-r5w8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:29:39Z"}]}}],"modified":"2026-10-02T18:25:28.826796534Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8e559842-83f3-4d84-b29b-44e9a2fede84","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vgvx-44cw-r5w8","advisory_id":"8e559842-83f3-4d84-b29b-44e9a2fede84","event_types":["advisory"],"published_at":"2026-10-25T22:24:48.063773+00:00","technologies":["core-osv","langfuse-fips-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:09:25+00:00","detail_url":"/advisories/advisory%3A8e559842-83f3-4d84-b29b-44e9a2fede84","group":{"id":"advisory:8e559842-83f3-4d84-b29b-44e9a2fede84","revision":1,"primary_event_id":70810,"change":"published","superseded_by":[],"changed":{"id":70810,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-vgvx-44cw-r5w8","summary":"CGA-vgvx-44cw-r5w8","evidence":"osv:CGA-vgvx-44cw-r5w8","products":[{"name":{"value":"langfuse-fips-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vgvx-44cw-r5w8","aliases":["CGA-vgvx-44cw-r5w8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4","purl":"pkg:apk/chainguard/langfuse-fips-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgvx-44cw-r5w8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:29:39Z"}]}}],"modified":"2026-10-02T18:25:28.826796534Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8e559842-83f3-4d84-b29b-44e9a2fede84","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vgvx-44cw-r5w8","advisory_id":"8e559842-83f3-4d84-b29b-44e9a2fede84","event_types":["advisory"],"published_at":"2026-10-25T22:24:48.063773+00:00","technologies":["core-osv","langfuse-fips-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:09:25+00:00","detail_url":"/events/70810"},"members":[{"id":70810,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-vgvx-44cw-r5w8","summary":"CGA-vgvx-44cw-r5w8","evidence":"osv:CGA-vgvx-44cw-r5w8","products":[{"name":{"value":"langfuse-fips-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vgvx-44cw-r5w8","aliases":["CGA-vgvx-44cw-r5w8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4","purl":"pkg:apk/chainguard/langfuse-fips-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgvx-44cw-r5w8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:29:39Z"}]}}],"modified":"2026-10-02T18:25:28.826796534Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8e559842-83f3-4d84-b29b-44e9a2fede84","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vgvx-44cw-r5w8","advisory_id":"8e559842-83f3-4d84-b29b-44e9a2fede84","event_types":["advisory"],"published_at":"2026-10-25T22:24:48.063773+00:00","technologies":["core-osv","langfuse-fips-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:09:25+00:00","detail_url":"/events/70810"}]}},{"id":70402,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-mjv2-73cr-g36q","summary":"CGA-mjv2-73cr-g36q","evidence":"osv:CGA-mjv2-73cr-g36q","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.7-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mjv2-73cr-g36q","aliases":["CGA-mjv2-73cr-g36q"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7-r16"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mjv2-73cr-g36q.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:24:02Z"}]}}],"modified":"2026-10-02T18:25:26.939584851Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b4f8a3a7-9d4e-4564-b159-39c5de1b6362","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mjv2-73cr-g36q","advisory_id":"b4f8a3a7-9d4e-4564-b159-39c5de1b6362","event_types":["advisory"],"published_at":"2026-10-25T22:23:27.380275+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T10:56:26+00:00","detail_url":"/advisories/advisory%3Ab4f8a3a7-9d4e-4564-b159-39c5de1b6362","group":{"id":"advisory:b4f8a3a7-9d4e-4564-b159-39c5de1b6362","revision":1,"primary_event_id":70772,"change":"published","superseded_by":[],"changed":{"id":70772,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-mjv2-73cr-g36q","summary":"CGA-mjv2-73cr-g36q","evidence":"osv:CGA-mjv2-73cr-g36q","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.7-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mjv2-73cr-g36q","aliases":["CGA-mjv2-73cr-g36q"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7-r16"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mjv2-73cr-g36q.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:24:02Z"}]}}],"modified":"2026-10-02T18:25:26.939584851Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b4f8a3a7-9d4e-4564-b159-39c5de1b6362","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mjv2-73cr-g36q","advisory_id":"b4f8a3a7-9d4e-4564-b159-39c5de1b6362","event_types":["advisory"],"published_at":"2026-10-25T22:23:27.380275+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T10:56:26+00:00","detail_url":"/events/70772"},"members":[{"id":70772,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-mjv2-73cr-g36q","summary":"CGA-mjv2-73cr-g36q","evidence":"osv:CGA-mjv2-73cr-g36q","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.7-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mjv2-73cr-g36q","aliases":["CGA-mjv2-73cr-g36q"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7-r16"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mjv2-73cr-g36q.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:24:02Z"}]}}],"modified":"2026-10-02T18:25:26.939584851Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b4f8a3a7-9d4e-4564-b159-39c5de1b6362","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mjv2-73cr-g36q","advisory_id":"b4f8a3a7-9d4e-4564-b159-39c5de1b6362","event_types":["advisory"],"published_at":"2026-10-25T22:23:27.380275+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T10:56:26+00:00","detail_url":"/events/70772"}]}},{"id":70394,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-hj2x-vrgq-q833","summary":"CGA-hj2x-vrgq-q833","evidence":"osv:CGA-hj2x-vrgq-q833","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.7-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hj2x-vrgq-q833","aliases":["CGA-hj2x-vrgq-q833"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7-r16"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hj2x-vrgq-q833.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:24:01Z"}]}}],"modified":"2026-10-02T18:25:26.520248443Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a94cb555-0bb9-43af-8f01-e04ae6f069ec","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hj2x-vrgq-q833","advisory_id":"a94cb555-0bb9-43af-8f01-e04ae6f069ec","event_types":["advisory"],"published_at":"2026-10-25T22:23:17.536353+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T10:56:26+00:00","detail_url":"/advisories/advisory%3Aa94cb555-0bb9-43af-8f01-e04ae6f069ec","group":{"id":"advisory:a94cb555-0bb9-43af-8f01-e04ae6f069ec","revision":1,"primary_event_id":70764,"change":"published","superseded_by":[],"changed":{"id":70764,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-hj2x-vrgq-q833","summary":"CGA-hj2x-vrgq-q833","evidence":"osv:CGA-hj2x-vrgq-q833","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.7-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hj2x-vrgq-q833","aliases":["CGA-hj2x-vrgq-q833"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7-r16"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hj2x-vrgq-q833.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:24:01Z"}]}}],"modified":"2026-10-02T18:25:26.520248443Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a94cb555-0bb9-43af-8f01-e04ae6f069ec","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hj2x-vrgq-q833","advisory_id":"a94cb555-0bb9-43af-8f01-e04ae6f069ec","event_types":["advisory"],"published_at":"2026-10-25T22:23:17.536353+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T10:56:26+00:00","detail_url":"/events/70764"},"members":[{"id":70764,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-hj2x-vrgq-q833","summary":"CGA-hj2x-vrgq-q833","evidence":"osv:CGA-hj2x-vrgq-q833","products":[{"name":{"value":"librechat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.7-r16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hj2x-vrgq-q833","aliases":["CGA-hj2x-vrgq-q833"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.7-r16"}]}],"package":{"name":"librechat","purl":"pkg:apk/chainguard/librechat?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hj2x-vrgq-q833.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T21:24:01Z"}]}}],"modified":"2026-10-02T18:25:26.520248443Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a94cb555-0bb9-43af-8f01-e04ae6f069ec","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hj2x-vrgq-q833","advisory_id":"a94cb555-0bb9-43af-8f01-e04ae6f069ec","event_types":["advisory"],"published_at":"2026-10-25T22:23:17.536353+00:00","technologies":["core-osv","librechat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T10:56:26+00:00","detail_url":"/events/70764"}]}},{"id":70087,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-3w5r-vpw6-rch7","summary":"CGA-3w5r-vpw6-rch7","evidence":"osv:CGA-3w5r-vpw6-rch7","products":[{"name":{"value":"semaphore","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.12-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3w5r-vpw6-rch7","aliases":["CGA-3w5r-vpw6-rch7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.12-r3"}]}],"package":{"name":"semaphore","purl":"pkg:apk/chainguard/semaphore?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3w5r-vpw6-rch7.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/semaphore/embedded-ui/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:59:06Z"}]}}],"modified":"2026-10-02T18:25:12.019617074Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9ac37647-d95b-4531-abc0-6b9c66f77668","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3w5r-vpw6-rch7","advisory_id":"9ac37647-d95b-4531-abc0-6b9c66f77668","event_types":["advisory"],"published_at":"2026-10-25T22:13:54.010649+00:00","technologies":["core-osv","semaphore"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:20:09+00:00","detail_url":"/advisories/advisory%3A9ac37647-d95b-4531-abc0-6b9c66f77668","group":{"id":"advisory:9ac37647-d95b-4531-abc0-6b9c66f77668","revision":1,"primary_event_id":70457,"change":"published","superseded_by":[],"changed":{"id":70457,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-3w5r-vpw6-rch7","summary":"CGA-3w5r-vpw6-rch7","evidence":"osv:CGA-3w5r-vpw6-rch7","products":[{"name":{"value":"semaphore","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.12-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3w5r-vpw6-rch7","aliases":["CGA-3w5r-vpw6-rch7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.12-r3"}]}],"package":{"name":"semaphore","purl":"pkg:apk/chainguard/semaphore?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3w5r-vpw6-rch7.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/semaphore/embedded-ui/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:59:06Z"}]}}],"modified":"2026-10-02T18:25:12.019617074Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9ac37647-d95b-4531-abc0-6b9c66f77668","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3w5r-vpw6-rch7","advisory_id":"9ac37647-d95b-4531-abc0-6b9c66f77668","event_types":["advisory"],"published_at":"2026-10-25T22:13:54.010649+00:00","technologies":["core-osv","semaphore"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:20:09+00:00","detail_url":"/events/70457"},"members":[{"id":70457,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-3w5r-vpw6-rch7","summary":"CGA-3w5r-vpw6-rch7","evidence":"osv:CGA-3w5r-vpw6-rch7","products":[{"name":{"value":"semaphore","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.19.12-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3w5r-vpw6-rch7","aliases":["CGA-3w5r-vpw6-rch7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.12-r3"}]}],"package":{"name":"semaphore","purl":"pkg:apk/chainguard/semaphore?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3w5r-vpw6-rch7.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/usr/share/semaphore/embedded-ui/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:59:06Z"}]}}],"modified":"2026-10-02T18:25:12.019617074Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9ac37647-d95b-4531-abc0-6b9c66f77668","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3w5r-vpw6-rch7","advisory_id":"9ac37647-d95b-4531-abc0-6b9c66f77668","event_types":["advisory"],"published_at":"2026-10-25T22:13:54.010649+00:00","technologies":["core-osv","semaphore"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:20:09+00:00","detail_url":"/events/70457"}]}},{"id":69897,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"MINI-7q6r-8ph3-r2px","summary":"MINI-7q6r-8ph3-r2px","evidence":"osv:MINI-7q6r-8ph3-r2px","products":[{"name":{"value":"unleash-server","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-7q6r-8ph3-r2px","aliases":["MINI-7q6r-8ph3-r2px"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-r0"}]}],"package":{"name":"unleash-server","purl":"pkg:apk/minimos/unleash-server","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-7q6r-8ph3-r2px.json"}}],"modified":"2026-10-02T18:23:24.039115230Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":[]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:af770544-2705-442f-a40a-22c5483f8491","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-7q6r-8ph3-r2px","advisory_id":"af770544-2705-442f-a40a-22c5483f8491","event_types":["advisory"],"published_at":"2026-10-25T22:09:55.959675+00:00","technologies":["core-osv","unleash-server"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:12:26+00:00","detail_url":"/advisories/advisory%3Aaf770544-2705-442f-a40a-22c5483f8491","group":{"id":"advisory:af770544-2705-442f-a40a-22c5483f8491","revision":1,"primary_event_id":70267,"change":"published","superseded_by":[],"changed":{"id":70267,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"MINI-7q6r-8ph3-r2px","summary":"MINI-7q6r-8ph3-r2px","evidence":"osv:MINI-7q6r-8ph3-r2px","products":[{"name":{"value":"unleash-server","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-7q6r-8ph3-r2px","aliases":["MINI-7q6r-8ph3-r2px"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-r0"}]}],"package":{"name":"unleash-server","purl":"pkg:apk/minimos/unleash-server","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-7q6r-8ph3-r2px.json"}}],"modified":"2026-10-02T18:23:24.039115230Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":[]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:af770544-2705-442f-a40a-22c5483f8491","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-7q6r-8ph3-r2px","advisory_id":"af770544-2705-442f-a40a-22c5483f8491","event_types":["advisory"],"published_at":"2026-10-25T22:09:55.959675+00:00","technologies":["core-osv","unleash-server"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:12:26+00:00","detail_url":"/events/70267"},"members":[{"id":70267,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"MINI-7q6r-8ph3-r2px","summary":"MINI-7q6r-8ph3-r2px","evidence":"osv:MINI-7q6r-8ph3-r2px","products":[{"name":{"value":"unleash-server","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.2.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-7q6r-8ph3-r2px","aliases":["MINI-7q6r-8ph3-r2px"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-r0"}]}],"package":{"name":"unleash-server","purl":"pkg:apk/minimos/unleash-server","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-7q6r-8ph3-r2px.json"}}],"modified":"2026-10-02T18:23:24.039115230Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":[]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:af770544-2705-442f-a40a-22c5483f8491","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-7q6r-8ph3-r2px","advisory_id":"af770544-2705-442f-a40a-22c5483f8491","event_types":["advisory"],"published_at":"2026-10-25T22:09:55.959675+00:00","technologies":["core-osv","unleash-server"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:12:26+00:00","detail_url":"/events/70267"}]}}],"next_after":73183,"next_before":69897}