{"schema_version":"2","view":"grouped","data":[{"id":76722,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-8ccw-vxjq-4658","summary":"CGA-8ccw-vxjq-4658","evidence":"osv:CGA-8ccw-vxjq-4658","products":[{"name":{"value":"kibana-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8ccw-vxjq-4658","aliases":["CGA-8ccw-vxjq-4658"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"kibana-9.5","purl":"pkg:apk/chainguard/kibana-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8ccw-vxjq-4658.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/kibana/node_modules/glob/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:12:19Z"}]}}],"modified":"2026-10-05T18:15:34.406868573Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ded81ef3-5120-40ed-be8f-d9a7481f8245","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8ccw-vxjq-4658","advisory_id":"ded81ef3-5120-40ed-be8f-d9a7481f8245","event_types":["advisory"],"published_at":"2026-10-27T01:52:14.070038+00:00","technologies":["core-osv","kibana-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:44:56+00:00","detail_url":"/advisories/advisory%3Aded81ef3-5120-40ed-be8f-d9a7481f8245","group":{"id":"advisory:ded81ef3-5120-40ed-be8f-d9a7481f8245","revision":1,"primary_event_id":84945,"change":"published","superseded_by":[],"changed":{"id":84945,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-8ccw-vxjq-4658","summary":"CGA-8ccw-vxjq-4658","evidence":"osv:CGA-8ccw-vxjq-4658","products":[{"name":{"value":"kibana-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8ccw-vxjq-4658","aliases":["CGA-8ccw-vxjq-4658"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"kibana-9.5","purl":"pkg:apk/chainguard/kibana-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8ccw-vxjq-4658.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/kibana/node_modules/glob/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:12:19Z"}]}}],"modified":"2026-10-05T18:15:34.406868573Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ded81ef3-5120-40ed-be8f-d9a7481f8245","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8ccw-vxjq-4658","advisory_id":"ded81ef3-5120-40ed-be8f-d9a7481f8245","event_types":["advisory"],"published_at":"2026-10-27T01:52:14.070038+00:00","technologies":["core-osv","kibana-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:44:56+00:00","detail_url":"/events/84945"},"members":[{"id":84945,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-8ccw-vxjq-4658","summary":"CGA-8ccw-vxjq-4658","evidence":"osv:CGA-8ccw-vxjq-4658","products":[{"name":{"value":"kibana-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-8ccw-vxjq-4658","aliases":["CGA-8ccw-vxjq-4658"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"kibana-9.5","purl":"pkg:apk/chainguard/kibana-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8ccw-vxjq-4658.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/kibana/node_modules/glob/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:12:19Z"}]}}],"modified":"2026-10-05T18:15:34.406868573Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ded81ef3-5120-40ed-be8f-d9a7481f8245","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8ccw-vxjq-4658","advisory_id":"ded81ef3-5120-40ed-be8f-d9a7481f8245","event_types":["advisory"],"published_at":"2026-10-27T01:52:14.070038+00:00","technologies":["core-osv","kibana-9-5"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:44:56+00:00","detail_url":"/events/84945"}]}},{"id":76592,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-22p7-76h8-5q2p","summary":"CGA-22p7-76h8-5q2p","evidence":"osv:CGA-22p7-76h8-5q2p","products":[{"name":{"value":"kibana-8.19-bitnami","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-22p7-76h8-5q2p","aliases":["CGA-22p7-76h8-5q2p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r5"}]}],"package":{"name":"kibana-8.19-bitnami","purl":"pkg:apk/chainguard/kibana-8.19-bitnami?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-22p7-76h8-5q2p.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/opt/bitnami/kibana/node_modules/minimatch/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:29:12Z"}]}}],"modified":"2026-10-05T18:15:12.810718660Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d92f671d-a52e-4f2d-bca7-600b921561f4","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-22p7-76h8-5q2p","advisory_id":"d92f671d-a52e-4f2d-bca7-600b921561f4","event_types":["advisory"],"published_at":"2026-10-26T23:47:30.417655+00:00","technologies":["core-osv","kibana-8-19-bitnami"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:52:33+00:00","detail_url":"/advisories/advisory%3Ad92f671d-a52e-4f2d-bca7-600b921561f4","group":{"id":"advisory:d92f671d-a52e-4f2d-bca7-600b921561f4","revision":1,"primary_event_id":84574,"change":"published","superseded_by":[],"changed":{"id":84574,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-22p7-76h8-5q2p","summary":"CGA-22p7-76h8-5q2p","evidence":"osv:CGA-22p7-76h8-5q2p","products":[{"name":{"value":"kibana-8.19-bitnami","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-22p7-76h8-5q2p","aliases":["CGA-22p7-76h8-5q2p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r5"}]}],"package":{"name":"kibana-8.19-bitnami","purl":"pkg:apk/chainguard/kibana-8.19-bitnami?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-22p7-76h8-5q2p.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/opt/bitnami/kibana/node_modules/minimatch/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:29:12Z"}]}}],"modified":"2026-10-05T18:15:12.810718660Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d92f671d-a52e-4f2d-bca7-600b921561f4","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-22p7-76h8-5q2p","advisory_id":"d92f671d-a52e-4f2d-bca7-600b921561f4","event_types":["advisory"],"published_at":"2026-10-26T23:47:30.417655+00:00","technologies":["core-osv","kibana-8-19-bitnami"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:52:33+00:00","detail_url":"/events/84574"},"members":[{"id":84574,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-22p7-76h8-5q2p","summary":"CGA-22p7-76h8-5q2p","evidence":"osv:CGA-22p7-76h8-5q2p","products":[{"name":{"value":"kibana-8.19-bitnami","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-22p7-76h8-5q2p","aliases":["CGA-22p7-76h8-5q2p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r5"}]}],"package":{"name":"kibana-8.19-bitnami","purl":"pkg:apk/chainguard/kibana-8.19-bitnami?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-22p7-76h8-5q2p.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/opt/bitnami/kibana/node_modules/minimatch/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:29:12Z"}]}}],"modified":"2026-10-05T18:15:12.810718660Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d92f671d-a52e-4f2d-bca7-600b921561f4","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-22p7-76h8-5q2p","advisory_id":"d92f671d-a52e-4f2d-bca7-600b921561f4","event_types":["advisory"],"published_at":"2026-10-26T23:47:30.417655+00:00","technologies":["core-osv","kibana-8-19-bitnami"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:52:33+00:00","detail_url":"/events/84574"}]}},{"id":75293,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"MINI-p3r6-2h7q-xqr5","summary":"MINI-p3r6-2h7q-xqr5","evidence":"osv:MINI-p3r6-2h7q-xqr5","products":[{"name":{"value":"langfuse-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-p3r6-2h7q-xqr5","aliases":["MINI-p3r6-2h7q-xqr5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r0"}]}],"package":{"name":"langfuse-4-worker","purl":"pkg:apk/minimos/langfuse-4-worker","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p3r6-2h7q-xqr5.json"}}],"modified":"2026-10-04T16:45:15.414366665Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":[]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3eafa62d-8346-45fe-a9c9-359065411946","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-p3r6-2h7q-xqr5","advisory_id":"3eafa62d-8346-45fe-a9c9-359065411946","event_types":["advisory"],"published_at":"2026-10-26T16:36:26.446522+00:00","technologies":["core-osv","langfuse-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-04T15:48:56+00:00","detail_url":"/advisories/advisory%3A3eafa62d-8346-45fe-a9c9-359065411946","group":{"id":"advisory:3eafa62d-8346-45fe-a9c9-359065411946","revision":1,"primary_event_id":81757,"change":"published","superseded_by":[],"changed":{"id":81757,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"MINI-p3r6-2h7q-xqr5","summary":"MINI-p3r6-2h7q-xqr5","evidence":"osv:MINI-p3r6-2h7q-xqr5","products":[{"name":{"value":"langfuse-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-p3r6-2h7q-xqr5","aliases":["MINI-p3r6-2h7q-xqr5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r0"}]}],"package":{"name":"langfuse-4-worker","purl":"pkg:apk/minimos/langfuse-4-worker","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p3r6-2h7q-xqr5.json"}}],"modified":"2026-10-04T16:45:15.414366665Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":[]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3eafa62d-8346-45fe-a9c9-359065411946","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-p3r6-2h7q-xqr5","advisory_id":"3eafa62d-8346-45fe-a9c9-359065411946","event_types":["advisory"],"published_at":"2026-10-26T16:36:26.446522+00:00","technologies":["core-osv","langfuse-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-04T15:48:56+00:00","detail_url":"/events/81757"},"members":[{"id":81757,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"MINI-p3r6-2h7q-xqr5","summary":"MINI-p3r6-2h7q-xqr5","evidence":"osv:MINI-p3r6-2h7q-xqr5","products":[{"name":{"value":"langfuse-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-p3r6-2h7q-xqr5","aliases":["MINI-p3r6-2h7q-xqr5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r0"}]}],"package":{"name":"langfuse-4-worker","purl":"pkg:apk/minimos/langfuse-4-worker","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p3r6-2h7q-xqr5.json"}}],"modified":"2026-10-04T16:45:15.414366665Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":[]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3eafa62d-8346-45fe-a9c9-359065411946","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-p3r6-2h7q-xqr5","advisory_id":"3eafa62d-8346-45fe-a9c9-359065411946","event_types":["advisory"],"published_at":"2026-10-26T16:36:26.446522+00:00","technologies":["core-osv","langfuse-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-04T15:48:56+00:00","detail_url":"/events/81757"}]}},{"id":75212,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"MINI-49fv-g965-4rc4","summary":"MINI-49fv-g965-4rc4","evidence":"osv:MINI-49fv-g965-4rc4","products":[{"name":{"value":"verdaccio","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.10.5-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-49fv-g965-4rc4","aliases":["MINI-49fv-g965-4rc4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.5-r0"}]}],"package":{"name":"verdaccio","purl":"pkg:apk/minimos/verdaccio","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-49fv-g965-4rc4.json"}}],"modified":"2026-10-04T16:45:06.102651750Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":[]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:16277ff2-9cbb-424e-b90e-26d84ba2fcb6","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-49fv-g965-4rc4","advisory_id":"16277ff2-9cbb-424e-b90e-26d84ba2fcb6","event_types":["advisory"],"published_at":"2026-10-26T16:32:23.237356+00:00","technologies":["core-osv","verdaccio"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-04T15:49:45+00:00","detail_url":"/advisories/advisory%3A16277ff2-9cbb-424e-b90e-26d84ba2fcb6","group":{"id":"advisory:16277ff2-9cbb-424e-b90e-26d84ba2fcb6","revision":1,"primary_event_id":81675,"change":"published","superseded_by":[],"changed":{"id":81675,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"MINI-49fv-g965-4rc4","summary":"MINI-49fv-g965-4rc4","evidence":"osv:MINI-49fv-g965-4rc4","products":[{"name":{"value":"verdaccio","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.10.5-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-49fv-g965-4rc4","aliases":["MINI-49fv-g965-4rc4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.5-r0"}]}],"package":{"name":"verdaccio","purl":"pkg:apk/minimos/verdaccio","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-49fv-g965-4rc4.json"}}],"modified":"2026-10-04T16:45:06.102651750Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":[]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:16277ff2-9cbb-424e-b90e-26d84ba2fcb6","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-49fv-g965-4rc4","advisory_id":"16277ff2-9cbb-424e-b90e-26d84ba2fcb6","event_types":["advisory"],"published_at":"2026-10-26T16:32:23.237356+00:00","technologies":["core-osv","verdaccio"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-04T15:49:45+00:00","detail_url":"/events/81675"},"members":[{"id":81675,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"MINI-49fv-g965-4rc4","summary":"MINI-49fv-g965-4rc4","evidence":"osv:MINI-49fv-g965-4rc4","products":[{"name":{"value":"verdaccio","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.10.5-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-49fv-g965-4rc4","aliases":["MINI-49fv-g965-4rc4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.5-r0"}]}],"package":{"name":"verdaccio","purl":"pkg:apk/minimos/verdaccio","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-49fv-g965-4rc4.json"}}],"modified":"2026-10-04T16:45:06.102651750Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":[]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:16277ff2-9cbb-424e-b90e-26d84ba2fcb6","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-49fv-g965-4rc4","advisory_id":"16277ff2-9cbb-424e-b90e-26d84ba2fcb6","event_types":["advisory"],"published_at":"2026-10-26T16:32:23.237356+00:00","technologies":["core-osv","verdaccio"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-04T15:49:45+00:00","detail_url":"/events/81675"}]}},{"id":75147,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"MINI-3f77-m92v-2xmr","summary":"MINI-3f77-m92v-2xmr","evidence":"osv:MINI-3f77-m92v-2xmr","products":[{"name":{"value":"arangodb-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"arangodb-3.11-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.14.2-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-3f77-m92v-2xmr","aliases":["MINI-3f77-m92v-2xmr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"arangodb-3.11","purl":"pkg:apk/minimos/arangodb-3.11","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-3f77-m92v-2xmr.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.14.2-r1"}]}],"package":{"name":"arangodb-3.11-compat","purl":"pkg:apk/minimos/arangodb-3.11-compat","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-3f77-m92v-2xmr.json"}}],"modified":"2026-10-04T10:45:05.589836170Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":[]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:994d73e1-d304-485f-b2ab-17be6804c533","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-3f77-m92v-2xmr","advisory_id":"994d73e1-d304-485f-b2ab-17be6804c533","event_types":["advisory"],"published_at":"2026-10-26T16:05:29.977825+00:00","technologies":["arangodb-3-11","arangodb-3-11-compat","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:37:03+00:00","detail_url":"/advisories/advisory%3A994d73e1-d304-485f-b2ab-17be6804c533","group":{"id":"advisory:994d73e1-d304-485f-b2ab-17be6804c533","revision":1,"primary_event_id":81561,"change":"published","superseded_by":[],"changed":{"id":81561,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"MINI-3f77-m92v-2xmr","summary":"MINI-3f77-m92v-2xmr","evidence":"osv:MINI-3f77-m92v-2xmr","products":[{"name":{"value":"arangodb-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"arangodb-3.11-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.14.2-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-3f77-m92v-2xmr","aliases":["MINI-3f77-m92v-2xmr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"arangodb-3.11","purl":"pkg:apk/minimos/arangodb-3.11","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-3f77-m92v-2xmr.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.14.2-r1"}]}],"package":{"name":"arangodb-3.11-compat","purl":"pkg:apk/minimos/arangodb-3.11-compat","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-3f77-m92v-2xmr.json"}}],"modified":"2026-10-04T10:45:05.589836170Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":[]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:994d73e1-d304-485f-b2ab-17be6804c533","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-3f77-m92v-2xmr","advisory_id":"994d73e1-d304-485f-b2ab-17be6804c533","event_types":["advisory"],"published_at":"2026-10-26T16:05:29.977825+00:00","technologies":["arangodb-3-11","arangodb-3-11-compat","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:37:03+00:00","detail_url":"/events/81561"},"members":[{"id":81561,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"MINI-3f77-m92v-2xmr","summary":"MINI-3f77-m92v-2xmr","evidence":"osv:MINI-3f77-m92v-2xmr","products":[{"name":{"value":"arangodb-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"arangodb-3.11-compat","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.14.2-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-3f77-m92v-2xmr","aliases":["MINI-3f77-m92v-2xmr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"arangodb-3.11","purl":"pkg:apk/minimos/arangodb-3.11","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-3f77-m92v-2xmr.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.14.2-r1"}]}],"package":{"name":"arangodb-3.11-compat","purl":"pkg:apk/minimos/arangodb-3.11-compat","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-3f77-m92v-2xmr.json"}}],"modified":"2026-10-04T10:45:05.589836170Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":[]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:994d73e1-d304-485f-b2ab-17be6804c533","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-3f77-m92v-2xmr","advisory_id":"994d73e1-d304-485f-b2ab-17be6804c533","event_types":["advisory"],"published_at":"2026-10-26T16:05:29.977825+00:00","technologies":["arangodb-3-11","arangodb-3-11-compat","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:37:03+00:00","detail_url":"/events/81561"}]}},{"id":74575,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5m59-6fm8-hgvv","summary":"CGA-5m59-6fm8-hgvv","evidence":"osv:CGA-5m59-6fm8-hgvv","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5m59-6fm8-hgvv","aliases":["CGA-5m59-6fm8-hgvv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5m59-6fm8-hgvv.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:11Z"}]}}],"modified":"2026-10-03T17:25:08.472408650Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:99af7c98-67f0-4568-9944-b12b8dabc2b9","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5m59-6fm8-hgvv","advisory_id":"99af7c98-67f0-4568-9944-b12b8dabc2b9","event_types":["advisory"],"published_at":"2026-10-26T11:31:05.872911+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:31+00:00","detail_url":"/advisories/advisory%3A99af7c98-67f0-4568-9944-b12b8dabc2b9","group":{"id":"advisory:99af7c98-67f0-4568-9944-b12b8dabc2b9","revision":1,"primary_event_id":79974,"change":"published","superseded_by":[],"changed":{"id":79974,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5m59-6fm8-hgvv","summary":"CGA-5m59-6fm8-hgvv","evidence":"osv:CGA-5m59-6fm8-hgvv","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5m59-6fm8-hgvv","aliases":["CGA-5m59-6fm8-hgvv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5m59-6fm8-hgvv.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:11Z"}]}}],"modified":"2026-10-03T17:25:08.472408650Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:99af7c98-67f0-4568-9944-b12b8dabc2b9","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5m59-6fm8-hgvv","advisory_id":"99af7c98-67f0-4568-9944-b12b8dabc2b9","event_types":["advisory"],"published_at":"2026-10-26T11:31:05.872911+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:31+00:00","detail_url":"/events/79974"},"members":[{"id":79974,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5m59-6fm8-hgvv","summary":"CGA-5m59-6fm8-hgvv","evidence":"osv:CGA-5m59-6fm8-hgvv","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5m59-6fm8-hgvv","aliases":["CGA-5m59-6fm8-hgvv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5m59-6fm8-hgvv.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:11Z"}]}}],"modified":"2026-10-03T17:25:08.472408650Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:99af7c98-67f0-4568-9944-b12b8dabc2b9","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5m59-6fm8-hgvv","advisory_id":"99af7c98-67f0-4568-9944-b12b8dabc2b9","event_types":["advisory"],"published_at":"2026-10-26T11:31:05.872911+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:31+00:00","detail_url":"/events/79974"}]}},{"id":74491,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-2mg5-p4x3-5q9v","summary":"CGA-2mg5-p4x3-5q9v","evidence":"osv:CGA-2mg5-p4x3-5q9v","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2mg5-p4x3-5q9v","aliases":["CGA-2mg5-p4x3-5q9v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mg5-p4x3-5q9v.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/build/frontend-legacy/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:10Z"}]}}],"modified":"2026-10-03T17:24:45.663842133Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:09016adc-a7ac-4653-a175-2e018ef1ab0a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mg5-p4x3-5q9v","advisory_id":"09016adc-a7ac-4653-a175-2e018ef1ab0a","event_types":["advisory"],"published_at":"2026-10-26T10:53:25.8811+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:06:04+00:00","detail_url":"/advisories/advisory%3A09016adc-a7ac-4653-a175-2e018ef1ab0a","group":{"id":"advisory:09016adc-a7ac-4653-a175-2e018ef1ab0a","revision":1,"primary_event_id":79649,"change":"published","superseded_by":[],"changed":{"id":79649,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-2mg5-p4x3-5q9v","summary":"CGA-2mg5-p4x3-5q9v","evidence":"osv:CGA-2mg5-p4x3-5q9v","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2mg5-p4x3-5q9v","aliases":["CGA-2mg5-p4x3-5q9v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mg5-p4x3-5q9v.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/build/frontend-legacy/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:10Z"}]}}],"modified":"2026-10-03T17:24:45.663842133Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:09016adc-a7ac-4653-a175-2e018ef1ab0a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mg5-p4x3-5q9v","advisory_id":"09016adc-a7ac-4653-a175-2e018ef1ab0a","event_types":["advisory"],"published_at":"2026-10-26T10:53:25.8811+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:06:04+00:00","detail_url":"/events/79649"},"members":[{"id":79649,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-2mg5-p4x3-5q9v","summary":"CGA-2mg5-p4x3-5q9v","evidence":"osv:CGA-2mg5-p4x3-5q9v","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2mg5-p4x3-5q9v","aliases":["CGA-2mg5-p4x3-5q9v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mg5-p4x3-5q9v.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/build/frontend-legacy/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:10Z"}]}}],"modified":"2026-10-03T17:24:45.663842133Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:09016adc-a7ac-4653-a175-2e018ef1ab0a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mg5-p4x3-5q9v","advisory_id":"09016adc-a7ac-4653-a175-2e018ef1ab0a","event_types":["advisory"],"published_at":"2026-10-26T10:53:25.8811+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:06:04+00:00","detail_url":"/events/79649"}]}},{"id":73027,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-mr7p-f445-vqrc","summary":"CGA-mr7p-f445-vqrc","evidence":"osv:CGA-mr7p-f445-vqrc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mr7p-f445-vqrc","aliases":["CGA-mr7p-f445-vqrc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mr7p-f445-vqrc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:09Z"}]}}],"modified":"2026-10-03T10:32:45.234915165Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25e79e31-5031-4ee1-90d3-3e1d8d107af6","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mr7p-f445-vqrc","advisory_id":"25e79e31-5031-4ee1-90d3-3e1d8d107af6","event_types":["advisory"],"published_at":"2026-10-26T02:23:15.260237+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/advisories/advisory%3A25e79e31-5031-4ee1-90d3-3e1d8d107af6","group":{"id":"advisory:25e79e31-5031-4ee1-90d3-3e1d8d107af6","revision":1,"primary_event_id":74444,"change":"published","superseded_by":[],"changed":{"id":74444,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-mr7p-f445-vqrc","summary":"CGA-mr7p-f445-vqrc","evidence":"osv:CGA-mr7p-f445-vqrc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mr7p-f445-vqrc","aliases":["CGA-mr7p-f445-vqrc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mr7p-f445-vqrc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:09Z"}]}}],"modified":"2026-10-03T10:32:45.234915165Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25e79e31-5031-4ee1-90d3-3e1d8d107af6","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mr7p-f445-vqrc","advisory_id":"25e79e31-5031-4ee1-90d3-3e1d8d107af6","event_types":["advisory"],"published_at":"2026-10-26T02:23:15.260237+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/events/74444"},"members":[{"id":74444,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-mr7p-f445-vqrc","summary":"CGA-mr7p-f445-vqrc","evidence":"osv:CGA-mr7p-f445-vqrc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mr7p-f445-vqrc","aliases":["CGA-mr7p-f445-vqrc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mr7p-f445-vqrc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:09Z"}]}}],"modified":"2026-10-03T10:32:45.234915165Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25e79e31-5031-4ee1-90d3-3e1d8d107af6","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mr7p-f445-vqrc","advisory_id":"25e79e31-5031-4ee1-90d3-3e1d8d107af6","event_types":["advisory"],"published_at":"2026-10-26T02:23:15.260237+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/events/74444"}]}},{"id":72865,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-9j6h-cjwx-wrjc","summary":"CGA-9j6h-cjwx-wrjc","evidence":"osv:CGA-9j6h-cjwx-wrjc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9j6h-cjwx-wrjc","aliases":["CGA-9j6h-cjwx-wrjc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9j6h-cjwx-wrjc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:32:38.357295791Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ea29c4f6-2f1e-4215-b1df-12016921c029","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9j6h-cjwx-wrjc","advisory_id":"ea29c4f6-2f1e-4215-b1df-12016921c029","event_types":["advisory"],"published_at":"2026-10-26T01:20:07.947369+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/advisories/advisory%3Aea29c4f6-2f1e-4215-b1df-12016921c029","group":{"id":"advisory:ea29c4f6-2f1e-4215-b1df-12016921c029","revision":1,"primary_event_id":73752,"change":"published","superseded_by":[],"changed":{"id":73752,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-9j6h-cjwx-wrjc","summary":"CGA-9j6h-cjwx-wrjc","evidence":"osv:CGA-9j6h-cjwx-wrjc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9j6h-cjwx-wrjc","aliases":["CGA-9j6h-cjwx-wrjc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9j6h-cjwx-wrjc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:32:38.357295791Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ea29c4f6-2f1e-4215-b1df-12016921c029","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9j6h-cjwx-wrjc","advisory_id":"ea29c4f6-2f1e-4215-b1df-12016921c029","event_types":["advisory"],"published_at":"2026-10-26T01:20:07.947369+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/events/73752"},"members":[{"id":73752,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-9j6h-cjwx-wrjc","summary":"CGA-9j6h-cjwx-wrjc","evidence":"osv:CGA-9j6h-cjwx-wrjc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9j6h-cjwx-wrjc","aliases":["CGA-9j6h-cjwx-wrjc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9j6h-cjwx-wrjc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:32:38.357295791Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ea29c4f6-2f1e-4215-b1df-12016921c029","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9j6h-cjwx-wrjc","advisory_id":"ea29c4f6-2f1e-4215-b1df-12016921c029","event_types":["advisory"],"published_at":"2026-10-26T01:20:07.947369+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/events/73752"}]}},{"id":72492,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-p7r8-95r4-9mj9","summary":"CGA-p7r8-95r4-9mj9","evidence":"osv:CGA-p7r8-95r4-9mj9","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-p7r8-95r4-9mj9","aliases":["CGA-p7r8-95r4-9mj9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p7r8-95r4-9mj9.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:30:12.728235138Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4c608fc3-86d5-42c9-9a57-166771af7220","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p7r8-95r4-9mj9","advisory_id":"4c608fc3-86d5-42c9-9a57-166771af7220","event_types":["advisory"],"published_at":"2026-10-26T00:24:24.717065+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/advisories/advisory%3A4c608fc3-86d5-42c9-9a57-166771af7220","group":{"id":"advisory:4c608fc3-86d5-42c9-9a57-166771af7220","revision":1,"primary_event_id":73140,"change":"published","superseded_by":[],"changed":{"id":73140,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-p7r8-95r4-9mj9","summary":"CGA-p7r8-95r4-9mj9","evidence":"osv:CGA-p7r8-95r4-9mj9","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-p7r8-95r4-9mj9","aliases":["CGA-p7r8-95r4-9mj9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p7r8-95r4-9mj9.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:30:12.728235138Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4c608fc3-86d5-42c9-9a57-166771af7220","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p7r8-95r4-9mj9","advisory_id":"4c608fc3-86d5-42c9-9a57-166771af7220","event_types":["advisory"],"published_at":"2026-10-26T00:24:24.717065+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/events/73140"},"members":[{"id":73140,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-p7r8-95r4-9mj9","summary":"CGA-p7r8-95r4-9mj9","evidence":"osv:CGA-p7r8-95r4-9mj9","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-p7r8-95r4-9mj9","aliases":["CGA-p7r8-95r4-9mj9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p7r8-95r4-9mj9.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:30:12.728235138Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4c608fc3-86d5-42c9-9a57-166771af7220","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p7r8-95r4-9mj9","advisory_id":"4c608fc3-86d5-42c9-9a57-166771af7220","event_types":["advisory"],"published_at":"2026-10-26T00:24:24.717065+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/events/73140"}]}},{"id":71847,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-ghgr-8r3w-cfxv","summary":"CGA-ghgr-8r3w-cfxv","evidence":"osv:CGA-ghgr-8r3w-cfxv","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-ghgr-8r3w-cfxv","aliases":["CGA-ghgr-8r3w-cfxv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ghgr-8r3w-cfxv.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:38:05Z"}]}}],"modified":"2026-10-02T23:01:33.588730118Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7c2153cf-2138-4655-ad2c-d5ad71670d33","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ghgr-8r3w-cfxv","advisory_id":"7c2153cf-2138-4655-ad2c-d5ad71670d33","event_types":["advisory"],"published_at":"2026-10-25T23:44:07.283127+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:36:26+00:00","detail_url":"/advisories/advisory%3A7c2153cf-2138-4655-ad2c-d5ad71670d33","group":{"id":"advisory:7c2153cf-2138-4655-ad2c-d5ad71670d33","revision":1,"primary_event_id":72341,"change":"published","superseded_by":[],"changed":{"id":72341,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-ghgr-8r3w-cfxv","summary":"CGA-ghgr-8r3w-cfxv","evidence":"osv:CGA-ghgr-8r3w-cfxv","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-ghgr-8r3w-cfxv","aliases":["CGA-ghgr-8r3w-cfxv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ghgr-8r3w-cfxv.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:38:05Z"}]}}],"modified":"2026-10-02T23:01:33.588730118Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7c2153cf-2138-4655-ad2c-d5ad71670d33","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ghgr-8r3w-cfxv","advisory_id":"7c2153cf-2138-4655-ad2c-d5ad71670d33","event_types":["advisory"],"published_at":"2026-10-25T23:44:07.283127+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:36:26+00:00","detail_url":"/events/72341"},"members":[{"id":72341,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-ghgr-8r3w-cfxv","summary":"CGA-ghgr-8r3w-cfxv","evidence":"osv:CGA-ghgr-8r3w-cfxv","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-ghgr-8r3w-cfxv","aliases":["CGA-ghgr-8r3w-cfxv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ghgr-8r3w-cfxv.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:38:05Z"}]}}],"modified":"2026-10-02T23:01:33.588730118Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7c2153cf-2138-4655-ad2c-d5ad71670d33","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ghgr-8r3w-cfxv","advisory_id":"7c2153cf-2138-4655-ad2c-d5ad71670d33","event_types":["advisory"],"published_at":"2026-10-25T23:44:07.283127+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:36:26+00:00","detail_url":"/events/72341"}]}},{"id":71568,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5f7v-4wg6-c48w","summary":"CGA-5f7v-4wg6-c48w","evidence":"osv:CGA-5f7v-4wg6-c48w","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5f7v-4wg6-c48w","aliases":["CGA-5f7v-4wg6-c48w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5f7v-4wg6-c48w.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:01:06.108519280Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42ce658c-a18c-4488-9637-b9a8e773bf1e","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5f7v-4wg6-c48w","advisory_id":"42ce658c-a18c-4488-9637-b9a8e773bf1e","event_types":["advisory"],"published_at":"2026-10-25T23:19:52.628917+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:29+00:00","detail_url":"/advisories/advisory%3A42ce658c-a18c-4488-9637-b9a8e773bf1e","group":{"id":"advisory:42ce658c-a18c-4488-9637-b9a8e773bf1e","revision":1,"primary_event_id":71985,"change":"published","superseded_by":[],"changed":{"id":71985,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5f7v-4wg6-c48w","summary":"CGA-5f7v-4wg6-c48w","evidence":"osv:CGA-5f7v-4wg6-c48w","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5f7v-4wg6-c48w","aliases":["CGA-5f7v-4wg6-c48w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5f7v-4wg6-c48w.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:01:06.108519280Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42ce658c-a18c-4488-9637-b9a8e773bf1e","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5f7v-4wg6-c48w","advisory_id":"42ce658c-a18c-4488-9637-b9a8e773bf1e","event_types":["advisory"],"published_at":"2026-10-25T23:19:52.628917+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:29+00:00","detail_url":"/events/71985"},"members":[{"id":71985,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5f7v-4wg6-c48w","summary":"CGA-5f7v-4wg6-c48w","evidence":"osv:CGA-5f7v-4wg6-c48w","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5f7v-4wg6-c48w","aliases":["CGA-5f7v-4wg6-c48w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5f7v-4wg6-c48w.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:01:06.108519280Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42ce658c-a18c-4488-9637-b9a8e773bf1e","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5f7v-4wg6-c48w","advisory_id":"42ce658c-a18c-4488-9637-b9a8e773bf1e","event_types":["advisory"],"published_at":"2026-10-25T23:19:52.628917+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:29+00:00","detail_url":"/events/71985"}]}},{"id":71222,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-g3gr-pr43-p8rx","summary":"CGA-g3gr-pr43-p8rx","evidence":"osv:CGA-g3gr-pr43-p8rx","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-g3gr-pr43-p8rx","aliases":["CGA-g3gr-pr43-p8rx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g3gr-pr43-p8rx.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:11Z"}]}}],"modified":"2026-10-02T23:00:30.496377596Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:be295428-881f-401a-a277-1b94aac03f54","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g3gr-pr43-p8rx","advisory_id":"be295428-881f-401a-a277-1b94aac03f54","event_types":["advisory"],"published_at":"2026-10-25T22:57:13.87297+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:06:06+00:00","detail_url":"/advisories/advisory%3Abe295428-881f-401a-a277-1b94aac03f54","group":{"id":"advisory:be295428-881f-401a-a277-1b94aac03f54","revision":1,"primary_event_id":71607,"change":"published","superseded_by":[],"changed":{"id":71607,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-g3gr-pr43-p8rx","summary":"CGA-g3gr-pr43-p8rx","evidence":"osv:CGA-g3gr-pr43-p8rx","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-g3gr-pr43-p8rx","aliases":["CGA-g3gr-pr43-p8rx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g3gr-pr43-p8rx.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:11Z"}]}}],"modified":"2026-10-02T23:00:30.496377596Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:be295428-881f-401a-a277-1b94aac03f54","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g3gr-pr43-p8rx","advisory_id":"be295428-881f-401a-a277-1b94aac03f54","event_types":["advisory"],"published_at":"2026-10-25T22:57:13.87297+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:06:06+00:00","detail_url":"/events/71607"},"members":[{"id":71607,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-g3gr-pr43-p8rx","summary":"CGA-g3gr-pr43-p8rx","evidence":"osv:CGA-g3gr-pr43-p8rx","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-g3gr-pr43-p8rx","aliases":["CGA-g3gr-pr43-p8rx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g3gr-pr43-p8rx.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T15:46:11Z"}]}}],"modified":"2026-10-02T23:00:30.496377596Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:be295428-881f-401a-a277-1b94aac03f54","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g3gr-pr43-p8rx","advisory_id":"be295428-881f-401a-a277-1b94aac03f54","event_types":["advisory"],"published_at":"2026-10-25T22:57:13.87297+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:06:06+00:00","detail_url":"/events/71607"}]}},{"id":71210,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-9m56-27cc-5jc5","summary":"CGA-9m56-27cc-5jc5","evidence":"osv:CGA-9m56-27cc-5jc5","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9m56-27cc-5jc5","aliases":["CGA-9m56-27cc-5jc5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9m56-27cc-5jc5.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/build/frontend-legacy/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:38:05Z"}]}}],"modified":"2026-10-02T23:00:29.108274392Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e0d9fa23-8c87-475f-9124-07fdfa861c3c","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9m56-27cc-5jc5","advisory_id":"e0d9fa23-8c87-475f-9124-07fdfa861c3c","event_types":["advisory"],"published_at":"2026-10-25T22:56:34.188863+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:36:24+00:00","detail_url":"/advisories/advisory%3Ae0d9fa23-8c87-475f-9124-07fdfa861c3c","group":{"id":"advisory:e0d9fa23-8c87-475f-9124-07fdfa861c3c","revision":1,"primary_event_id":71595,"change":"published","superseded_by":[],"changed":{"id":71595,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-9m56-27cc-5jc5","summary":"CGA-9m56-27cc-5jc5","evidence":"osv:CGA-9m56-27cc-5jc5","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9m56-27cc-5jc5","aliases":["CGA-9m56-27cc-5jc5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9m56-27cc-5jc5.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/build/frontend-legacy/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:38:05Z"}]}}],"modified":"2026-10-02T23:00:29.108274392Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e0d9fa23-8c87-475f-9124-07fdfa861c3c","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9m56-27cc-5jc5","advisory_id":"e0d9fa23-8c87-475f-9124-07fdfa861c3c","event_types":["advisory"],"published_at":"2026-10-25T22:56:34.188863+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:36:24+00:00","detail_url":"/events/71595"},"members":[{"id":71595,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-9m56-27cc-5jc5","summary":"CGA-9m56-27cc-5jc5","evidence":"osv:CGA-9m56-27cc-5jc5","products":[{"name":{"value":"nextcloud-server-34","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"34.0.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9m56-27cc-5jc5","aliases":["CGA-9m56-27cc-5jc5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"34.0.4-r3"}]}],"package":{"name":"nextcloud-server-34","purl":"pkg:apk/chainguard/nextcloud-server-34?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9m56-27cc-5jc5.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/usr/src/nextcloud/build/frontend-legacy/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:38:05Z"}]}}],"modified":"2026-10-02T23:00:29.108274392Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e0d9fa23-8c87-475f-9124-07fdfa861c3c","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9m56-27cc-5jc5","advisory_id":"e0d9fa23-8c87-475f-9124-07fdfa861c3c","event_types":["advisory"],"published_at":"2026-10-25T22:56:34.188863+00:00","technologies":["core-osv","nextcloud-server-34"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:36:24+00:00","detail_url":"/events/71595"}]}},{"id":71067,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-3hhv-qc6c-46jj","summary":"CGA-3hhv-qc6c-46jj","evidence":"osv:CGA-3hhv-qc6c-46jj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3hhv-qc6c-46jj","aliases":["CGA-3hhv-qc6c-46jj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hhv-qc6c-46jj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:00:12.955277168Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hhv-qc6c-46jj","advisory_id":"c3c3c9a2-769c-445c-a429-6c90b93be634","event_types":["advisory"],"published_at":"2026-10-25T22:49:14.925024+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/advisories/advisory%3Ac3c3c9a2-769c-445c-a429-6c90b93be634","group":{"id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","revision":1,"primary_event_id":71441,"change":"published","superseded_by":[],"changed":{"id":71441,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-3hhv-qc6c-46jj","summary":"CGA-3hhv-qc6c-46jj","evidence":"osv:CGA-3hhv-qc6c-46jj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3hhv-qc6c-46jj","aliases":["CGA-3hhv-qc6c-46jj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hhv-qc6c-46jj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:00:12.955277168Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hhv-qc6c-46jj","advisory_id":"c3c3c9a2-769c-445c-a429-6c90b93be634","event_types":["advisory"],"published_at":"2026-10-25T22:49:14.925024+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/events/71441"},"members":[{"id":71441,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-3hhv-qc6c-46jj","summary":"CGA-3hhv-qc6c-46jj","evidence":"osv:CGA-3hhv-qc6c-46jj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3hhv-qc6c-46jj","aliases":["CGA-3hhv-qc6c-46jj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hhv-qc6c-46jj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:00:12.955277168Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hhv-qc6c-46jj","advisory_id":"c3c3c9a2-769c-445c-a429-6c90b93be634","event_types":["advisory"],"published_at":"2026-10-25T22:49:14.925024+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/events/71441"}]}},{"id":70769,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-rjfh-c645-cfx5","summary":"CGA-rjfh-c645-cfx5","evidence":"osv:CGA-rjfh-c645-cfx5","products":[{"name":{"value":"langfuse-fips-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rjfh-c645-cfx5","aliases":["CGA-rjfh-c645-cfx5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4-worker","purl":"pkg:apk/chainguard/langfuse-fips-4-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rjfh-c645-cfx5.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/app/node_modules/.pnpm/brace-expansion@1.1.18/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:20:25Z"}]}}],"modified":"2026-10-02T18:25:45.197885340Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a4c6b631-663e-466f-b1db-9ed1b1e079fc","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rjfh-c645-cfx5","advisory_id":"a4c6b631-663e-466f-b1db-9ed1b1e079fc","event_types":["advisory"],"published_at":"2026-10-25T22:38:37.355993+00:00","technologies":["core-osv","langfuse-fips-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:48:16+00:00","detail_url":"/advisories/advisory%3Aa4c6b631-663e-466f-b1db-9ed1b1e079fc","group":{"id":"advisory:a4c6b631-663e-466f-b1db-9ed1b1e079fc","revision":1,"primary_event_id":71140,"change":"published","superseded_by":[],"changed":{"id":71140,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-rjfh-c645-cfx5","summary":"CGA-rjfh-c645-cfx5","evidence":"osv:CGA-rjfh-c645-cfx5","products":[{"name":{"value":"langfuse-fips-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rjfh-c645-cfx5","aliases":["CGA-rjfh-c645-cfx5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4-worker","purl":"pkg:apk/chainguard/langfuse-fips-4-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rjfh-c645-cfx5.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/app/node_modules/.pnpm/brace-expansion@1.1.18/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:20:25Z"}]}}],"modified":"2026-10-02T18:25:45.197885340Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a4c6b631-663e-466f-b1db-9ed1b1e079fc","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rjfh-c645-cfx5","advisory_id":"a4c6b631-663e-466f-b1db-9ed1b1e079fc","event_types":["advisory"],"published_at":"2026-10-25T22:38:37.355993+00:00","technologies":["core-osv","langfuse-fips-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:48:16+00:00","detail_url":"/events/71140"},"members":[{"id":71140,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-rjfh-c645-cfx5","summary":"CGA-rjfh-c645-cfx5","evidence":"osv:CGA-rjfh-c645-cfx5","products":[{"name":{"value":"langfuse-fips-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rjfh-c645-cfx5","aliases":["CGA-rjfh-c645-cfx5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4-worker","purl":"pkg:apk/chainguard/langfuse-fips-4-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rjfh-c645-cfx5.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/app/node_modules/.pnpm/brace-expansion@1.1.18/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:20:25Z"}]}}],"modified":"2026-10-02T18:25:45.197885340Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a4c6b631-663e-466f-b1db-9ed1b1e079fc","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rjfh-c645-cfx5","advisory_id":"a4c6b631-663e-466f-b1db-9ed1b1e079fc","event_types":["advisory"],"published_at":"2026-10-25T22:38:37.355993+00:00","technologies":["core-osv","langfuse-fips-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:48:16+00:00","detail_url":"/events/71140"}]}},{"id":70666,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-jj9j-92pc-f742","summary":"CGA-jj9j-92pc-f742","evidence":"osv:CGA-jj9j-92pc-f742","products":[{"name":{"value":"langfuse-fips-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-jj9j-92pc-f742","aliases":["CGA-jj9j-92pc-f742"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4-worker","purl":"pkg:apk/chainguard/langfuse-fips-4-worker?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jj9j-92pc-f742.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/app/pnpm-lock.yaml","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:46:11Z"}]}}],"modified":"2026-10-02T18:25:40.722388645Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f3bc1725-e2cc-42f8-ad02-868fcee7a1ed","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jj9j-92pc-f742","advisory_id":"f3bc1725-e2cc-42f8-ad02-868fcee7a1ed","event_types":["advisory"],"published_at":"2026-10-25T22:34:00.139711+00:00","technologies":["core-osv","langfuse-fips-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:24:33+00:00","detail_url":"/advisories/advisory%3Af3bc1725-e2cc-42f8-ad02-868fcee7a1ed","group":{"id":"advisory:f3bc1725-e2cc-42f8-ad02-868fcee7a1ed","revision":1,"primary_event_id":71037,"change":"published","superseded_by":[],"changed":{"id":71037,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-jj9j-92pc-f742","summary":"CGA-jj9j-92pc-f742","evidence":"osv:CGA-jj9j-92pc-f742","products":[{"name":{"value":"langfuse-fips-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-jj9j-92pc-f742","aliases":["CGA-jj9j-92pc-f742"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4-worker","purl":"pkg:apk/chainguard/langfuse-fips-4-worker?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jj9j-92pc-f742.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/app/pnpm-lock.yaml","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:46:11Z"}]}}],"modified":"2026-10-02T18:25:40.722388645Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f3bc1725-e2cc-42f8-ad02-868fcee7a1ed","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jj9j-92pc-f742","advisory_id":"f3bc1725-e2cc-42f8-ad02-868fcee7a1ed","event_types":["advisory"],"published_at":"2026-10-25T22:34:00.139711+00:00","technologies":["core-osv","langfuse-fips-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:24:33+00:00","detail_url":"/events/71037"},"members":[{"id":71037,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-jj9j-92pc-f742","summary":"CGA-jj9j-92pc-f742","evidence":"osv:CGA-jj9j-92pc-f742","products":[{"name":{"value":"langfuse-fips-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-jj9j-92pc-f742","aliases":["CGA-jj9j-92pc-f742"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4-worker","purl":"pkg:apk/chainguard/langfuse-fips-4-worker?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jj9j-92pc-f742.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/app/pnpm-lock.yaml","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:46:11Z"}]}}],"modified":"2026-10-02T18:25:40.722388645Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f3bc1725-e2cc-42f8-ad02-868fcee7a1ed","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jj9j-92pc-f742","advisory_id":"f3bc1725-e2cc-42f8-ad02-868fcee7a1ed","event_types":["advisory"],"published_at":"2026-10-25T22:34:00.139711+00:00","technologies":["core-osv","langfuse-fips-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:24:33+00:00","detail_url":"/events/71037"}]}},{"id":70553,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-fq6x-mx4c-hp75","summary":"CGA-fq6x-mx4c-hp75","evidence":"osv:CGA-fq6x-mx4c-hp75","products":[{"name":{"value":"langfuse-fips-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fq6x-mx4c-hp75","aliases":["CGA-fq6x-mx4c-hp75"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4-worker","purl":"pkg:apk/chainguard/langfuse-fips-4-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fq6x-mx4c-hp75.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/app/node_modules/.pnpm/brace-expansion@2.1.4/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:20:25Z"}]}}],"modified":"2026-10-02T18:25:34.332705343Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:60dd7469-c13b-48d1-87b2-9469c95d5872","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fq6x-mx4c-hp75","advisory_id":"60dd7469-c13b-48d1-87b2-9469c95d5872","event_types":["advisory"],"published_at":"2026-10-25T22:28:59.888345+00:00","technologies":["core-osv","langfuse-fips-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:48:19+00:00","detail_url":"/advisories/advisory%3A60dd7469-c13b-48d1-87b2-9469c95d5872","group":{"id":"advisory:60dd7469-c13b-48d1-87b2-9469c95d5872","revision":1,"primary_event_id":70923,"change":"published","superseded_by":[],"changed":{"id":70923,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-fq6x-mx4c-hp75","summary":"CGA-fq6x-mx4c-hp75","evidence":"osv:CGA-fq6x-mx4c-hp75","products":[{"name":{"value":"langfuse-fips-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fq6x-mx4c-hp75","aliases":["CGA-fq6x-mx4c-hp75"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4-worker","purl":"pkg:apk/chainguard/langfuse-fips-4-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fq6x-mx4c-hp75.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/app/node_modules/.pnpm/brace-expansion@2.1.4/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:20:25Z"}]}}],"modified":"2026-10-02T18:25:34.332705343Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:60dd7469-c13b-48d1-87b2-9469c95d5872","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fq6x-mx4c-hp75","advisory_id":"60dd7469-c13b-48d1-87b2-9469c95d5872","event_types":["advisory"],"published_at":"2026-10-25T22:28:59.888345+00:00","technologies":["core-osv","langfuse-fips-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:48:19+00:00","detail_url":"/events/70923"},"members":[{"id":70923,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-fq6x-mx4c-hp75","summary":"CGA-fq6x-mx4c-hp75","evidence":"osv:CGA-fq6x-mx4c-hp75","products":[{"name":{"value":"langfuse-fips-4-worker","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fq6x-mx4c-hp75","aliases":["CGA-fq6x-mx4c-hp75"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-fips-4-worker","purl":"pkg:apk/chainguard/langfuse-fips-4-worker?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fq6x-mx4c-hp75.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/app/node_modules/.pnpm/brace-expansion@2.1.4/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:20:25Z"}]}}],"modified":"2026-10-02T18:25:34.332705343Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:60dd7469-c13b-48d1-87b2-9469c95d5872","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fq6x-mx4c-hp75","advisory_id":"60dd7469-c13b-48d1-87b2-9469c95d5872","event_types":["advisory"],"published_at":"2026-10-25T22:28:59.888345+00:00","technologies":["core-osv","langfuse-fips-4-worker"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:48:19+00:00","detail_url":"/events/70923"}]}},{"id":70437,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-vqhj-352h-h4hc","summary":"CGA-vqhj-352h-h4hc","evidence":"osv:CGA-vqhj-352h-h4hc","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vqhj-352h-h4hc","aliases":["CGA-vqhj-352h-h4hc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vqhj-352h-h4hc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/srv/gitlab/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:56:48Z"}]}}],"modified":"2026-10-02T18:25:28.819766998Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8705f554-3431-429c-b6e7-1b0bd552200b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vqhj-352h-h4hc","advisory_id":"8705f554-3431-429c-b6e7-1b0bd552200b","event_types":["advisory"],"published_at":"2026-10-25T22:24:40.09648+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:10:56+00:00","detail_url":"/advisories/advisory%3A8705f554-3431-429c-b6e7-1b0bd552200b","group":{"id":"advisory:8705f554-3431-429c-b6e7-1b0bd552200b","revision":1,"primary_event_id":70807,"change":"published","superseded_by":[],"changed":{"id":70807,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-vqhj-352h-h4hc","summary":"CGA-vqhj-352h-h4hc","evidence":"osv:CGA-vqhj-352h-h4hc","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vqhj-352h-h4hc","aliases":["CGA-vqhj-352h-h4hc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vqhj-352h-h4hc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/srv/gitlab/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:56:48Z"}]}}],"modified":"2026-10-02T18:25:28.819766998Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8705f554-3431-429c-b6e7-1b0bd552200b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vqhj-352h-h4hc","advisory_id":"8705f554-3431-429c-b6e7-1b0bd552200b","event_types":["advisory"],"published_at":"2026-10-25T22:24:40.09648+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:10:56+00:00","detail_url":"/events/70807"},"members":[{"id":70807,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-vqhj-352h-h4hc","summary":"CGA-vqhj-352h-h4hc","evidence":"osv:CGA-vqhj-352h-h4hc","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vqhj-352h-h4hc","aliases":["CGA-vqhj-352h-h4hc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vqhj-352h-h4hc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/srv/gitlab/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:56:48Z"}]}}],"modified":"2026-10-02T18:25:28.819766998Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8705f554-3431-429c-b6e7-1b0bd552200b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vqhj-352h-h4hc","advisory_id":"8705f554-3431-429c-b6e7-1b0bd552200b","event_types":["advisory"],"published_at":"2026-10-25T22:24:40.09648+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:10:56+00:00","detail_url":"/events/70807"}]}},{"id":70435,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-v7qc-743j-m35h","summary":"CGA-v7qc-743j-m35h","evidence":"osv:CGA-v7qc-743j-m35h","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-v7qc-743j-m35h","aliases":["CGA-v7qc-743j-m35h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7qc-743j-m35h.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/srv/gitlab/storybook/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:56:48Z"}]}}],"modified":"2026-10-02T18:25:28.630951625Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:549bad84-1625-4e55-83a4-a95025534b06","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v7qc-743j-m35h","advisory_id":"549bad84-1625-4e55-83a4-a95025534b06","event_types":["advisory"],"published_at":"2026-10-25T22:24:35.483487+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:10:55+00:00","detail_url":"/advisories/advisory%3A549bad84-1625-4e55-83a4-a95025534b06","group":{"id":"advisory:549bad84-1625-4e55-83a4-a95025534b06","revision":1,"primary_event_id":70805,"change":"published","superseded_by":[],"changed":{"id":70805,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-v7qc-743j-m35h","summary":"CGA-v7qc-743j-m35h","evidence":"osv:CGA-v7qc-743j-m35h","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-v7qc-743j-m35h","aliases":["CGA-v7qc-743j-m35h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7qc-743j-m35h.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/srv/gitlab/storybook/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:56:48Z"}]}}],"modified":"2026-10-02T18:25:28.630951625Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:549bad84-1625-4e55-83a4-a95025534b06","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v7qc-743j-m35h","advisory_id":"549bad84-1625-4e55-83a4-a95025534b06","event_types":["advisory"],"published_at":"2026-10-25T22:24:35.483487+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:10:55+00:00","detail_url":"/events/70805"},"members":[{"id":70805,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-v7qc-743j-m35h","summary":"CGA-v7qc-743j-m35h","evidence":"osv:CGA-v7qc-743j-m35h","products":[{"name":{"value":"gitlab-rails-ce-18.9","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-v7qc-743j-m35h","aliases":["CGA-v7qc-743j-m35h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"gitlab-rails-ce-18.9","purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v7qc-743j-m35h.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/srv/gitlab/storybook/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:56:48Z"}]}}],"modified":"2026-10-02T18:25:28.630951625Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:549bad84-1625-4e55-83a4-a95025534b06","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v7qc-743j-m35h","advisory_id":"549bad84-1625-4e55-83a4-a95025534b06","event_types":["advisory"],"published_at":"2026-10-25T22:24:35.483487+00:00","technologies":["core-osv","gitlab-rails-ce-18-9"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:10:55+00:00","detail_url":"/events/70805"}]}},{"id":70123,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-4rg5-72j7-5g3f","summary":"CGA-4rg5-72j7-5g3f","evidence":"osv:CGA-4rg5-72j7-5g3f","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4rg5-72j7-5g3f","aliases":["CGA-4rg5-72j7-5g3f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4rg5-72j7-5g3f.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:13.767761270Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:12e13194-d263-4d35-9f61-55963115c551","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4rg5-72j7-5g3f","advisory_id":"12e13194-d263-4d35-9f61-55963115c551","event_types":["advisory"],"published_at":"2026-10-25T22:14:50.535339+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:43+00:00","detail_url":"/advisories/advisory%3A12e13194-d263-4d35-9f61-55963115c551","group":{"id":"advisory:12e13194-d263-4d35-9f61-55963115c551","revision":1,"primary_event_id":70493,"change":"published","superseded_by":[],"changed":{"id":70493,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-4rg5-72j7-5g3f","summary":"CGA-4rg5-72j7-5g3f","evidence":"osv:CGA-4rg5-72j7-5g3f","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4rg5-72j7-5g3f","aliases":["CGA-4rg5-72j7-5g3f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4rg5-72j7-5g3f.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:13.767761270Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:12e13194-d263-4d35-9f61-55963115c551","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4rg5-72j7-5g3f","advisory_id":"12e13194-d263-4d35-9f61-55963115c551","event_types":["advisory"],"published_at":"2026-10-25T22:14:50.535339+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:43+00:00","detail_url":"/events/70493"},"members":[{"id":70493,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-4rg5-72j7-5g3f","summary":"CGA-4rg5-72j7-5g3f","evidence":"osv:CGA-4rg5-72j7-5g3f","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4rg5-72j7-5g3f","aliases":["CGA-4rg5-72j7-5g3f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4rg5-72j7-5g3f.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:13.767761270Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:12e13194-d263-4d35-9f61-55963115c551","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4rg5-72j7-5g3f","advisory_id":"12e13194-d263-4d35-9f61-55963115c551","event_types":["advisory"],"published_at":"2026-10-25T22:14:50.535339+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:43+00:00","detail_url":"/events/70493"}]}},{"id":66906,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-vwfx-fqc6-hx42","summary":"CGA-vwfx-fqc6-hx42","evidence":"osv:CGA-vwfx-fqc6-hx42","products":[{"name":{"value":"nextcloud-server-33","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"33.0.9-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"nextcloud-server-33","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"33.0.9-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vwfx-fqc6-hx42","aliases":["CGA-vwfx-fqc6-hx42"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.0.9-r1"}]}],"package":{"name":"nextcloud-server-33","purl":"pkg:apk/chainguard/nextcloud-server-33?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vwfx-fqc6-hx42.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:03:11Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.0.9-r1"}]}],"package":{"name":"nextcloud-server-33","purl":"pkg:apk/wolfi/nextcloud-server-33?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vwfx-fqc6-hx42.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:03:11Z"}]}}],"modified":"2026-10-02T05:17:43.372813191Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7378237e-547e-4484-a0fc-847d4508b05f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vwfx-fqc6-hx42","advisory_id":"7378237e-547e-4484-a0fc-847d4508b05f","event_types":["advisory"],"published_at":"2026-10-25T21:06:59.548154+00:00","technologies":["core-osv","nextcloud-server-33"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:03:27+00:00","detail_url":"/advisories/advisory%3A7378237e-547e-4484-a0fc-847d4508b05f","group":{"id":"advisory:7378237e-547e-4484-a0fc-847d4508b05f","revision":1,"primary_event_id":67276,"change":"published","superseded_by":[],"changed":{"id":67276,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-vwfx-fqc6-hx42","summary":"CGA-vwfx-fqc6-hx42","evidence":"osv:CGA-vwfx-fqc6-hx42","products":[{"name":{"value":"nextcloud-server-33","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"33.0.9-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"nextcloud-server-33","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"33.0.9-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vwfx-fqc6-hx42","aliases":["CGA-vwfx-fqc6-hx42"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.0.9-r1"}]}],"package":{"name":"nextcloud-server-33","purl":"pkg:apk/chainguard/nextcloud-server-33?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vwfx-fqc6-hx42.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:03:11Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.0.9-r1"}]}],"package":{"name":"nextcloud-server-33","purl":"pkg:apk/wolfi/nextcloud-server-33?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vwfx-fqc6-hx42.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:03:11Z"}]}}],"modified":"2026-10-02T05:17:43.372813191Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7378237e-547e-4484-a0fc-847d4508b05f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vwfx-fqc6-hx42","advisory_id":"7378237e-547e-4484-a0fc-847d4508b05f","event_types":["advisory"],"published_at":"2026-10-25T21:06:59.548154+00:00","technologies":["core-osv","nextcloud-server-33"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:03:27+00:00","detail_url":"/events/67276"},"members":[{"id":67276,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-vwfx-fqc6-hx42","summary":"CGA-vwfx-fqc6-hx42","evidence":"osv:CGA-vwfx-fqc6-hx42","products":[{"name":{"value":"nextcloud-server-33","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"33.0.9-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"nextcloud-server-33","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"33.0.9-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vwfx-fqc6-hx42","aliases":["CGA-vwfx-fqc6-hx42"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.0.9-r1"}]}],"package":{"name":"nextcloud-server-33","purl":"pkg:apk/chainguard/nextcloud-server-33?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vwfx-fqc6-hx42.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:03:11Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.0.9-r1"}]}],"package":{"name":"nextcloud-server-33","purl":"pkg:apk/wolfi/nextcloud-server-33?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vwfx-fqc6-hx42.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/src/nextcloud/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:03:11Z"}]}}],"modified":"2026-10-02T05:17:43.372813191Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7378237e-547e-4484-a0fc-847d4508b05f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vwfx-fqc6-hx42","advisory_id":"7378237e-547e-4484-a0fc-847d4508b05f","event_types":["advisory"],"published_at":"2026-10-25T21:06:59.548154+00:00","technologies":["core-osv","nextcloud-server-33"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:03:27+00:00","detail_url":"/events/67276"}]}},{"id":66831,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-m3jj-92r7-jrvf","summary":"CGA-m3jj-92r7-jrvf","evidence":"osv:CGA-m3jj-92r7-jrvf","products":[{"name":{"value":"gitlab-rails-ce-fips-19.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"19.4.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m3jj-92r7-jrvf","aliases":["CGA-m3jj-92r7-jrvf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.4.1-r3"}]}],"package":{"name":"gitlab-rails-ce-fips-19.4","purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m3jj-92r7-jrvf.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/srv/gitlab/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T23:06:15Z"}]}}],"modified":"2026-10-02T05:17:42.355594587Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3bfe966b-51ad-4d39-a374-bfd4b0f46acc","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m3jj-92r7-jrvf","advisory_id":"3bfe966b-51ad-4d39-a374-bfd4b0f46acc","event_types":["advisory"],"published_at":"2026-10-25T21:05:52.326569+00:00","technologies":["core-osv","gitlab-rails-ce-fips-19-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:14:21+00:00","detail_url":"/advisories/advisory%3A3bfe966b-51ad-4d39-a374-bfd4b0f46acc","group":{"id":"advisory:3bfe966b-51ad-4d39-a374-bfd4b0f46acc","revision":1,"primary_event_id":67201,"change":"published","superseded_by":[],"changed":{"id":67201,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-m3jj-92r7-jrvf","summary":"CGA-m3jj-92r7-jrvf","evidence":"osv:CGA-m3jj-92r7-jrvf","products":[{"name":{"value":"gitlab-rails-ce-fips-19.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"19.4.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m3jj-92r7-jrvf","aliases":["CGA-m3jj-92r7-jrvf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.4.1-r3"}]}],"package":{"name":"gitlab-rails-ce-fips-19.4","purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m3jj-92r7-jrvf.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/srv/gitlab/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T23:06:15Z"}]}}],"modified":"2026-10-02T05:17:42.355594587Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3bfe966b-51ad-4d39-a374-bfd4b0f46acc","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m3jj-92r7-jrvf","advisory_id":"3bfe966b-51ad-4d39-a374-bfd4b0f46acc","event_types":["advisory"],"published_at":"2026-10-25T21:05:52.326569+00:00","technologies":["core-osv","gitlab-rails-ce-fips-19-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:14:21+00:00","detail_url":"/events/67201"},"members":[{"id":67201,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-m3jj-92r7-jrvf","summary":"CGA-m3jj-92r7-jrvf","evidence":"osv:CGA-m3jj-92r7-jrvf","products":[{"name":{"value":"gitlab-rails-ce-fips-19.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"19.4.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m3jj-92r7-jrvf","aliases":["CGA-m3jj-92r7-jrvf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.4.1-r3"}]}],"package":{"name":"gitlab-rails-ce-fips-19.4","purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m3jj-92r7-jrvf.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/srv/gitlab/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T23:06:15Z"}]}}],"modified":"2026-10-02T05:17:42.355594587Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3bfe966b-51ad-4d39-a374-bfd4b0f46acc","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m3jj-92r7-jrvf","advisory_id":"3bfe966b-51ad-4d39-a374-bfd4b0f46acc","event_types":["advisory"],"published_at":"2026-10-25T21:05:52.326569+00:00","technologies":["core-osv","gitlab-rails-ce-fips-19-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:14:21+00:00","detail_url":"/events/67201"}]}},{"id":66816,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-j9rh-3cfh-m6qr","summary":"CGA-j9rh-3cfh-m6qr","evidence":"osv:CGA-j9rh-3cfh-m6qr","products":[{"name":{"value":"wazuh-dashboard-index-management-dashboards-plugin-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-j9rh-3cfh-m6qr","aliases":["CGA-j9rh-3cfh-m6qr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-index-management-dashboards-plugin-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j9rh-3cfh-m6qr.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/indexManagementDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T23:58:44Z"}]}}],"modified":"2026-10-02T05:17:41.670077899Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:14a539f8-734d-4ef3-8f05-5c35fd951af2","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j9rh-3cfh-m6qr","advisory_id":"14a539f8-734d-4ef3-8f05-5c35fd951af2","event_types":["advisory"],"published_at":"2026-10-25T21:05:38.6271+00:00","technologies":["core-osv","wazuh-dashboard-index-management-dashboards-plugin-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:57:04+00:00","detail_url":"/advisories/advisory%3A14a539f8-734d-4ef3-8f05-5c35fd951af2","group":{"id":"advisory:14a539f8-734d-4ef3-8f05-5c35fd951af2","revision":1,"primary_event_id":67186,"change":"published","superseded_by":[],"changed":{"id":67186,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-j9rh-3cfh-m6qr","summary":"CGA-j9rh-3cfh-m6qr","evidence":"osv:CGA-j9rh-3cfh-m6qr","products":[{"name":{"value":"wazuh-dashboard-index-management-dashboards-plugin-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-j9rh-3cfh-m6qr","aliases":["CGA-j9rh-3cfh-m6qr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-index-management-dashboards-plugin-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j9rh-3cfh-m6qr.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/indexManagementDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T23:58:44Z"}]}}],"modified":"2026-10-02T05:17:41.670077899Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:14a539f8-734d-4ef3-8f05-5c35fd951af2","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j9rh-3cfh-m6qr","advisory_id":"14a539f8-734d-4ef3-8f05-5c35fd951af2","event_types":["advisory"],"published_at":"2026-10-25T21:05:38.6271+00:00","technologies":["core-osv","wazuh-dashboard-index-management-dashboards-plugin-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:57:04+00:00","detail_url":"/events/67186"},"members":[{"id":67186,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-j9rh-3cfh-m6qr","summary":"CGA-j9rh-3cfh-m6qr","evidence":"osv:CGA-j9rh-3cfh-m6qr","products":[{"name":{"value":"wazuh-dashboard-index-management-dashboards-plugin-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-j9rh-3cfh-m6qr","aliases":["CGA-j9rh-3cfh-m6qr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-index-management-dashboards-plugin-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j9rh-3cfh-m6qr.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/indexManagementDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T23:58:44Z"}]}}],"modified":"2026-10-02T05:17:41.670077899Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:14a539f8-734d-4ef3-8f05-5c35fd951af2","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j9rh-3cfh-m6qr","advisory_id":"14a539f8-734d-4ef3-8f05-5c35fd951af2","event_types":["advisory"],"published_at":"2026-10-25T21:05:38.6271+00:00","technologies":["core-osv","wazuh-dashboard-index-management-dashboards-plugin-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:57:04+00:00","detail_url":"/events/67186"}]}},{"id":66791,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-jw5q-pc46-h2q3","summary":"CGA-jw5q-pc46-h2q3","evidence":"osv:CGA-jw5q-pc46-h2q3","products":[{"name":{"value":"wazuh-dashboard-alerting-dashboards-plugin-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-jw5q-pc46-h2q3","aliases":["CGA-jw5q-pc46-h2q3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-alerting-dashboards-plugin-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jw5q-pc46-h2q3.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/alertingDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T23:53:55Z"}]}}],"modified":"2026-10-02T05:17:41.608014504Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:22a43fa2-b139-4bf4-a988-45c19669484b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jw5q-pc46-h2q3","advisory_id":"22a43fa2-b139-4bf4-a988-45c19669484b","event_types":["advisory"],"published_at":"2026-10-25T21:05:19.434232+00:00","technologies":["core-osv","wazuh-dashboard-alerting-dashboards-plugin-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:54:13+00:00","detail_url":"/advisories/advisory%3A22a43fa2-b139-4bf4-a988-45c19669484b","group":{"id":"advisory:22a43fa2-b139-4bf4-a988-45c19669484b","revision":1,"primary_event_id":67161,"change":"published","superseded_by":[],"changed":{"id":67161,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-jw5q-pc46-h2q3","summary":"CGA-jw5q-pc46-h2q3","evidence":"osv:CGA-jw5q-pc46-h2q3","products":[{"name":{"value":"wazuh-dashboard-alerting-dashboards-plugin-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-jw5q-pc46-h2q3","aliases":["CGA-jw5q-pc46-h2q3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-alerting-dashboards-plugin-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jw5q-pc46-h2q3.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/alertingDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T23:53:55Z"}]}}],"modified":"2026-10-02T05:17:41.608014504Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:22a43fa2-b139-4bf4-a988-45c19669484b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jw5q-pc46-h2q3","advisory_id":"22a43fa2-b139-4bf4-a988-45c19669484b","event_types":["advisory"],"published_at":"2026-10-25T21:05:19.434232+00:00","technologies":["core-osv","wazuh-dashboard-alerting-dashboards-plugin-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:54:13+00:00","detail_url":"/events/67161"},"members":[{"id":67161,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-jw5q-pc46-h2q3","summary":"CGA-jw5q-pc46-h2q3","evidence":"osv:CGA-jw5q-pc46-h2q3","products":[{"name":{"value":"wazuh-dashboard-alerting-dashboards-plugin-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-jw5q-pc46-h2q3","aliases":["CGA-jw5q-pc46-h2q3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-alerting-dashboards-plugin-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jw5q-pc46-h2q3.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/alertingDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T23:53:55Z"}]}}],"modified":"2026-10-02T05:17:41.608014504Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:22a43fa2-b139-4bf4-a988-45c19669484b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jw5q-pc46-h2q3","advisory_id":"22a43fa2-b139-4bf4-a988-45c19669484b","event_types":["advisory"],"published_at":"2026-10-25T21:05:19.434232+00:00","technologies":["core-osv","wazuh-dashboard-alerting-dashboards-plugin-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:54:13+00:00","detail_url":"/events/67161"}]}},{"id":66789,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-xfc8-5cxr-qqp3","summary":"CGA-xfc8-5cxr-qqp3","evidence":"osv:CGA-xfc8-5cxr-qqp3","products":[{"name":{"value":"wazuh-dashboard-dashboards-reporting-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xfc8-5cxr-qqp3","aliases":["CGA-xfc8-5cxr-qqp3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-dashboards-reporting-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfc8-5cxr-qqp3.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/reportsDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:41:22Z"}]}}],"modified":"2026-10-02T05:17:41.607360110Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5de80b19-2b7e-4b2d-8534-95ab3e7b6c81","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xfc8-5cxr-qqp3","advisory_id":"5de80b19-2b7e-4b2d-8534-95ab3e7b6c81","event_types":["advisory"],"published_at":"2026-10-25T21:05:18.444606+00:00","technologies":["core-osv","wazuh-dashboard-dashboards-reporting-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:56:15+00:00","detail_url":"/advisories/advisory%3A5de80b19-2b7e-4b2d-8534-95ab3e7b6c81","group":{"id":"advisory:5de80b19-2b7e-4b2d-8534-95ab3e7b6c81","revision":1,"primary_event_id":67159,"change":"published","superseded_by":[],"changed":{"id":67159,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-xfc8-5cxr-qqp3","summary":"CGA-xfc8-5cxr-qqp3","evidence":"osv:CGA-xfc8-5cxr-qqp3","products":[{"name":{"value":"wazuh-dashboard-dashboards-reporting-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xfc8-5cxr-qqp3","aliases":["CGA-xfc8-5cxr-qqp3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-dashboards-reporting-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfc8-5cxr-qqp3.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/reportsDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:41:22Z"}]}}],"modified":"2026-10-02T05:17:41.607360110Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5de80b19-2b7e-4b2d-8534-95ab3e7b6c81","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xfc8-5cxr-qqp3","advisory_id":"5de80b19-2b7e-4b2d-8534-95ab3e7b6c81","event_types":["advisory"],"published_at":"2026-10-25T21:05:18.444606+00:00","technologies":["core-osv","wazuh-dashboard-dashboards-reporting-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:56:15+00:00","detail_url":"/events/67159"},"members":[{"id":67159,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-xfc8-5cxr-qqp3","summary":"CGA-xfc8-5cxr-qqp3","evidence":"osv:CGA-xfc8-5cxr-qqp3","products":[{"name":{"value":"wazuh-dashboard-dashboards-reporting-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xfc8-5cxr-qqp3","aliases":["CGA-xfc8-5cxr-qqp3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-dashboards-reporting-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfc8-5cxr-qqp3.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/reportsDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:41:22Z"}]}}],"modified":"2026-10-02T05:17:41.607360110Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5de80b19-2b7e-4b2d-8534-95ab3e7b6c81","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xfc8-5cxr-qqp3","advisory_id":"5de80b19-2b7e-4b2d-8534-95ab3e7b6c81","event_types":["advisory"],"published_at":"2026-10-25T21:05:18.444606+00:00","technologies":["core-osv","wazuh-dashboard-dashboards-reporting-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:56:15+00:00","detail_url":"/events/67159"}]}},{"id":66776,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-xjh3-j6c9-xp9m","summary":"CGA-xjh3-j6c9-xp9m","evidence":"osv:CGA-xjh3-j6c9-xp9m","products":[{"name":{"value":"wazuh-dashboard-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xjh3-j6c9-xp9m","aliases":["CGA-xjh3-j6c9-xp9m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xjh3-j6c9-xp9m.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:50:16Z"}]}}],"modified":"2026-10-02T05:17:39.793830378Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:321fc032-441e-4351-a370-cc09471e273d","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xjh3-j6c9-xp9m","advisory_id":"321fc032-441e-4351-a370-cc09471e273d","event_types":["advisory"],"published_at":"2026-10-25T21:05:08.094384+00:00","technologies":["core-osv","wazuh-dashboard-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:29:42+00:00","detail_url":"/advisories/advisory%3A321fc032-441e-4351-a370-cc09471e273d","group":{"id":"advisory:321fc032-441e-4351-a370-cc09471e273d","revision":1,"primary_event_id":67146,"change":"published","superseded_by":[],"changed":{"id":67146,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-xjh3-j6c9-xp9m","summary":"CGA-xjh3-j6c9-xp9m","evidence":"osv:CGA-xjh3-j6c9-xp9m","products":[{"name":{"value":"wazuh-dashboard-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xjh3-j6c9-xp9m","aliases":["CGA-xjh3-j6c9-xp9m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xjh3-j6c9-xp9m.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:50:16Z"}]}}],"modified":"2026-10-02T05:17:39.793830378Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:321fc032-441e-4351-a370-cc09471e273d","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xjh3-j6c9-xp9m","advisory_id":"321fc032-441e-4351-a370-cc09471e273d","event_types":["advisory"],"published_at":"2026-10-25T21:05:08.094384+00:00","technologies":["core-osv","wazuh-dashboard-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:29:42+00:00","detail_url":"/events/67146"},"members":[{"id":67146,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-xjh3-j6c9-xp9m","summary":"CGA-xjh3-j6c9-xp9m","evidence":"osv:CGA-xjh3-j6c9-xp9m","products":[{"name":{"value":"wazuh-dashboard-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xjh3-j6c9-xp9m","aliases":["CGA-xjh3-j6c9-xp9m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xjh3-j6c9-xp9m.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:50:16Z"}]}}],"modified":"2026-10-02T05:17:39.793830378Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:321fc032-441e-4351-a370-cc09471e273d","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xjh3-j6c9-xp9m","advisory_id":"321fc032-441e-4351-a370-cc09471e273d","event_types":["advisory"],"published_at":"2026-10-25T21:05:08.094384+00:00","technologies":["core-osv","wazuh-dashboard-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:29:42+00:00","detail_url":"/events/67146"}]}},{"id":66773,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-x7w5-59h5-6cg2","summary":"CGA-x7w5-59h5-6cg2","evidence":"osv:CGA-x7w5-59h5-6cg2","products":[{"name":{"value":"lambda-nodejs22","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.2-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x7w5-59h5-6cg2","aliases":["CGA-x7w5-59h5-6cg2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r4"}]}],"package":{"name":"lambda-nodejs22","purl":"pkg:apk/chainguard/lambda-nodejs22?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x7w5-59h5-6cg2.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/var/runtime/node_modules/@aws-sdk/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:09:01Z"}]}}],"modified":"2026-10-02T05:17:39.668797172Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:dcfa6bf6-a724-487b-8d36-8eb994f6569b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x7w5-59h5-6cg2","advisory_id":"dcfa6bf6-a724-487b-8d36-8eb994f6569b","event_types":["advisory"],"published_at":"2026-10-25T21:05:05.454505+00:00","technologies":["core-osv","lambda-nodejs22"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:33:51+00:00","detail_url":"/advisories/advisory%3Adcfa6bf6-a724-487b-8d36-8eb994f6569b","group":{"id":"advisory:dcfa6bf6-a724-487b-8d36-8eb994f6569b","revision":1,"primary_event_id":67143,"change":"published","superseded_by":[],"changed":{"id":67143,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-x7w5-59h5-6cg2","summary":"CGA-x7w5-59h5-6cg2","evidence":"osv:CGA-x7w5-59h5-6cg2","products":[{"name":{"value":"lambda-nodejs22","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.2-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x7w5-59h5-6cg2","aliases":["CGA-x7w5-59h5-6cg2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r4"}]}],"package":{"name":"lambda-nodejs22","purl":"pkg:apk/chainguard/lambda-nodejs22?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x7w5-59h5-6cg2.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/var/runtime/node_modules/@aws-sdk/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:09:01Z"}]}}],"modified":"2026-10-02T05:17:39.668797172Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:dcfa6bf6-a724-487b-8d36-8eb994f6569b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x7w5-59h5-6cg2","advisory_id":"dcfa6bf6-a724-487b-8d36-8eb994f6569b","event_types":["advisory"],"published_at":"2026-10-25T21:05:05.454505+00:00","technologies":["core-osv","lambda-nodejs22"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:33:51+00:00","detail_url":"/events/67143"},"members":[{"id":67143,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-x7w5-59h5-6cg2","summary":"CGA-x7w5-59h5-6cg2","evidence":"osv:CGA-x7w5-59h5-6cg2","products":[{"name":{"value":"lambda-nodejs22","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.2-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x7w5-59h5-6cg2","aliases":["CGA-x7w5-59h5-6cg2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r4"}]}],"package":{"name":"lambda-nodejs22","purl":"pkg:apk/chainguard/lambda-nodejs22?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x7w5-59h5-6cg2.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/var/runtime/node_modules/@aws-sdk/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:09:01Z"}]}}],"modified":"2026-10-02T05:17:39.668797172Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:dcfa6bf6-a724-487b-8d36-8eb994f6569b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x7w5-59h5-6cg2","advisory_id":"dcfa6bf6-a724-487b-8d36-8eb994f6569b","event_types":["advisory"],"published_at":"2026-10-25T21:05:05.454505+00:00","technologies":["core-osv","lambda-nodejs22"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:33:51+00:00","detail_url":"/events/67143"}]}},{"id":66768,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-x7h6-xgvf-pj69","summary":"CGA-x7h6-xgvf-pj69","evidence":"osv:CGA-x7h6-xgvf-pj69","products":[{"name":{"value":"kibana-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x7h6-xgvf-pj69","aliases":["CGA-x7h6-xgvf-pj69"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"kibana-9.4","purl":"pkg:apk/chainguard/kibana-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x7h6-xgvf-pj69.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/kibana/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T22:03:53Z"}]}}],"modified":"2026-10-02T05:17:39.613445057Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e3a2bd43-58c6-4fef-ad97-5c96654ded12","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x7h6-xgvf-pj69","advisory_id":"e3a2bd43-58c6-4fef-ad97-5c96654ded12","event_types":["advisory"],"published_at":"2026-10-25T21:05:00.299159+00:00","technologies":["core-osv","kibana-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:20:21+00:00","detail_url":"/advisories/advisory%3Ae3a2bd43-58c6-4fef-ad97-5c96654ded12","group":{"id":"advisory:e3a2bd43-58c6-4fef-ad97-5c96654ded12","revision":1,"primary_event_id":67138,"change":"published","superseded_by":[],"changed":{"id":67138,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-x7h6-xgvf-pj69","summary":"CGA-x7h6-xgvf-pj69","evidence":"osv:CGA-x7h6-xgvf-pj69","products":[{"name":{"value":"kibana-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x7h6-xgvf-pj69","aliases":["CGA-x7h6-xgvf-pj69"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"kibana-9.4","purl":"pkg:apk/chainguard/kibana-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x7h6-xgvf-pj69.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/kibana/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T22:03:53Z"}]}}],"modified":"2026-10-02T05:17:39.613445057Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e3a2bd43-58c6-4fef-ad97-5c96654ded12","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x7h6-xgvf-pj69","advisory_id":"e3a2bd43-58c6-4fef-ad97-5c96654ded12","event_types":["advisory"],"published_at":"2026-10-25T21:05:00.299159+00:00","technologies":["core-osv","kibana-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:20:21+00:00","detail_url":"/events/67138"},"members":[{"id":67138,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-x7h6-xgvf-pj69","summary":"CGA-x7h6-xgvf-pj69","evidence":"osv:CGA-x7h6-xgvf-pj69","products":[{"name":{"value":"kibana-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-x7h6-xgvf-pj69","aliases":["CGA-x7h6-xgvf-pj69"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r3"}]}],"package":{"name":"kibana-9.4","purl":"pkg:apk/chainguard/kibana-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x7h6-xgvf-pj69.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/kibana/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T22:03:53Z"}]}}],"modified":"2026-10-02T05:17:39.613445057Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e3a2bd43-58c6-4fef-ad97-5c96654ded12","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x7h6-xgvf-pj69","advisory_id":"e3a2bd43-58c6-4fef-ad97-5c96654ded12","event_types":["advisory"],"published_at":"2026-10-25T21:05:00.299159+00:00","technologies":["core-osv","kibana-9-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:20:21+00:00","detail_url":"/events/67138"}]}},{"id":66703,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-v88p-7xm7-wcq4","summary":"CGA-v88p-7xm7-wcq4","evidence":"osv:CGA-v88p-7xm7-wcq4","products":[{"name":{"value":"wazuh-dashboard-dashboards-visualizations-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-v88p-7xm7-wcq4","aliases":["CGA-v88p-7xm7-wcq4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-dashboards-visualizations-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-visualizations-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v88p-7xm7-wcq4.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/ganttChartDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:20:37Z"}]}}],"modified":"2026-10-02T05:17:38.565829981Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3a018c71-8026-45b6-9810-be1032a29aa6","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v88p-7xm7-wcq4","advisory_id":"3a018c71-8026-45b6-9810-be1032a29aa6","event_types":["advisory"],"published_at":"2026-10-25T21:04:06.791006+00:00","technologies":["core-osv","wazuh-dashboard-dashboards-visualizations-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:37:13+00:00","detail_url":"/advisories/advisory%3A3a018c71-8026-45b6-9810-be1032a29aa6","group":{"id":"advisory:3a018c71-8026-45b6-9810-be1032a29aa6","revision":1,"primary_event_id":67073,"change":"published","superseded_by":[],"changed":{"id":67073,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-v88p-7xm7-wcq4","summary":"CGA-v88p-7xm7-wcq4","evidence":"osv:CGA-v88p-7xm7-wcq4","products":[{"name":{"value":"wazuh-dashboard-dashboards-visualizations-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-v88p-7xm7-wcq4","aliases":["CGA-v88p-7xm7-wcq4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-dashboards-visualizations-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-visualizations-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v88p-7xm7-wcq4.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/ganttChartDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:20:37Z"}]}}],"modified":"2026-10-02T05:17:38.565829981Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3a018c71-8026-45b6-9810-be1032a29aa6","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v88p-7xm7-wcq4","advisory_id":"3a018c71-8026-45b6-9810-be1032a29aa6","event_types":["advisory"],"published_at":"2026-10-25T21:04:06.791006+00:00","technologies":["core-osv","wazuh-dashboard-dashboards-visualizations-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:37:13+00:00","detail_url":"/events/67073"},"members":[{"id":67073,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-v88p-7xm7-wcq4","summary":"CGA-v88p-7xm7-wcq4","evidence":"osv:CGA-v88p-7xm7-wcq4","products":[{"name":{"value":"wazuh-dashboard-dashboards-visualizations-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-v88p-7xm7-wcq4","aliases":["CGA-v88p-7xm7-wcq4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r2"}]}],"package":{"name":"wazuh-dashboard-dashboards-visualizations-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-visualizations-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v88p-7xm7-wcq4.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/wazuh-dashboard/plugins/ganttChartDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:20:37Z"}]}}],"modified":"2026-10-02T05:17:38.565829981Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3a018c71-8026-45b6-9810-be1032a29aa6","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v88p-7xm7-wcq4","advisory_id":"3a018c71-8026-45b6-9810-be1032a29aa6","event_types":["advisory"],"published_at":"2026-10-25T21:04:06.791006+00:00","technologies":["core-osv","wazuh-dashboard-dashboards-visualizations-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:37:13+00:00","detail_url":"/events/67073"}]}}],"next_after":76722,"next_before":66703}