{"schema_version":"2","view":"grouped","data":[{"id":72030,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-wrwv-5p6c-x26p","summary":"CGA-wrwv-5p6c-x26p","evidence":"osv:CGA-wrwv-5p6c-x26p","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wrwv-5p6c-x26p","aliases":["CGA-wrwv-5p6c-x26p"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrwv-5p6c-x26p.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:10Z"}]}}],"modified":"2026-10-02T23:01:54.115637472Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8e505dba-7c6f-4cb6-a0e8-52f4facfef0d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrwv-5p6c-x26p","advisory_id":"8e505dba-7c6f-4cb6-a0e8-52f4facfef0d","event_types":["advisory"],"published_at":"2026-10-26T00:11:28.454948+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:41+00:00","detail_url":"/advisories/advisory%3A8e505dba-7c6f-4cb6-a0e8-52f4facfef0d","group":{"id":"advisory:8e505dba-7c6f-4cb6-a0e8-52f4facfef0d","revision":1,"primary_event_id":72649,"change":"published","superseded_by":[],"changed":{"id":72649,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-wrwv-5p6c-x26p","summary":"CGA-wrwv-5p6c-x26p","evidence":"osv:CGA-wrwv-5p6c-x26p","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wrwv-5p6c-x26p","aliases":["CGA-wrwv-5p6c-x26p"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrwv-5p6c-x26p.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:10Z"}]}}],"modified":"2026-10-02T23:01:54.115637472Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8e505dba-7c6f-4cb6-a0e8-52f4facfef0d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrwv-5p6c-x26p","advisory_id":"8e505dba-7c6f-4cb6-a0e8-52f4facfef0d","event_types":["advisory"],"published_at":"2026-10-26T00:11:28.454948+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:41+00:00","detail_url":"/events/72649"},"members":[{"id":72649,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-wrwv-5p6c-x26p","summary":"CGA-wrwv-5p6c-x26p","evidence":"osv:CGA-wrwv-5p6c-x26p","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wrwv-5p6c-x26p","aliases":["CGA-wrwv-5p6c-x26p"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wrwv-5p6c-x26p.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:10Z"}]}}],"modified":"2026-10-02T23:01:54.115637472Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:8e505dba-7c6f-4cb6-a0e8-52f4facfef0d","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wrwv-5p6c-x26p","advisory_id":"8e505dba-7c6f-4cb6-a0e8-52f4facfef0d","event_types":["advisory"],"published_at":"2026-10-26T00:11:28.454948+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:41+00:00","detail_url":"/events/72649"}]}},{"id":71851,"cve_ids":["CVE-2026-101900"],"payload":{"kind":"advisory","title":"CGA-hg55-m543-5gf8","summary":"CGA-hg55-m543-5gf8","evidence":"osv:CGA-hg55-m543-5gf8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hg55-m543-5gf8","aliases":["CGA-hg55-m543-5gf8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hg55-m543-5gf8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:01:34.182087753Z","provider":"osv","upstream":["CVE-2026-101900","GHSA-4hqw-qxg8-jxx2"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101900.json","https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","https://nvd.nist.gov/vuln/detail/CVE-2026-101900","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101900","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:798e77f6-78ba-46a3-b15f-d555e4c2fb6a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101900","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101900","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hg55-m543-5gf8","advisory_id":"798e77f6-78ba-46a3-b15f-d555e4c2fb6a","event_types":["advisory"],"published_at":"2026-10-25T23:44:17.158195+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:36+00:00","detail_url":"/advisories/advisory%3A798e77f6-78ba-46a3-b15f-d555e4c2fb6a","group":{"id":"advisory:798e77f6-78ba-46a3-b15f-d555e4c2fb6a","revision":1,"primary_event_id":72345,"change":"published","superseded_by":[],"changed":{"id":72345,"cve_ids":["CVE-2026-101900"],"payload":{"kind":"advisory","title":"CGA-hg55-m543-5gf8","summary":"CGA-hg55-m543-5gf8","evidence":"osv:CGA-hg55-m543-5gf8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hg55-m543-5gf8","aliases":["CGA-hg55-m543-5gf8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hg55-m543-5gf8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:01:34.182087753Z","provider":"osv","upstream":["CVE-2026-101900","GHSA-4hqw-qxg8-jxx2"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101900.json","https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","https://nvd.nist.gov/vuln/detail/CVE-2026-101900","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101900","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:798e77f6-78ba-46a3-b15f-d555e4c2fb6a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101900","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101900","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hg55-m543-5gf8","advisory_id":"798e77f6-78ba-46a3-b15f-d555e4c2fb6a","event_types":["advisory"],"published_at":"2026-10-25T23:44:17.158195+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:36+00:00","detail_url":"/events/72345"},"members":[{"id":72345,"cve_ids":["CVE-2026-101900"],"payload":{"kind":"advisory","title":"CGA-hg55-m543-5gf8","summary":"CGA-hg55-m543-5gf8","evidence":"osv:CGA-hg55-m543-5gf8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hg55-m543-5gf8","aliases":["CGA-hg55-m543-5gf8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hg55-m543-5gf8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:01:34.182087753Z","provider":"osv","upstream":["CVE-2026-101900","GHSA-4hqw-qxg8-jxx2"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101900.json","https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","https://nvd.nist.gov/vuln/detail/CVE-2026-101900","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101900","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:798e77f6-78ba-46a3-b15f-d555e4c2fb6a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101900","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101900","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hg55-m543-5gf8","advisory_id":"798e77f6-78ba-46a3-b15f-d555e4c2fb6a","event_types":["advisory"],"published_at":"2026-10-25T23:44:17.158195+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:36+00:00","detail_url":"/events/72345"}]}},{"id":71688,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7cxp-9fw7-m43f","summary":"CGA-7cxp-9fw7-m43f","evidence":"osv:CGA-7cxp-9fw7-m43f","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7cxp-9fw7-m43f","aliases":["CGA-7cxp-9fw7-m43f"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7cxp-9fw7-m43f.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:18Z"}]}}],"modified":"2026-10-02T23:01:17.794778353Z","provider":"osv","upstream":["GHSA-c2m8-h5v5-343r"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32","https://github.com/tornadoweb/tornado/commit/f9f50b8bab265a2abf9f2415a3d2da6264a5450b","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f8e22834-64da-43e7-8099-3e22b89ee505","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7cxp-9fw7-m43f","advisory_id":"f8e22834-64da-43e7-8099-3e22b89ee505","event_types":["advisory"],"published_at":"2026-10-25T23:29:14.378734+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:40+00:00","detail_url":"/advisories/advisory%3Af8e22834-64da-43e7-8099-3e22b89ee505","group":{"id":"advisory:f8e22834-64da-43e7-8099-3e22b89ee505","revision":1,"primary_event_id":72127,"change":"published","superseded_by":[],"changed":{"id":72127,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7cxp-9fw7-m43f","summary":"CGA-7cxp-9fw7-m43f","evidence":"osv:CGA-7cxp-9fw7-m43f","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7cxp-9fw7-m43f","aliases":["CGA-7cxp-9fw7-m43f"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7cxp-9fw7-m43f.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:18Z"}]}}],"modified":"2026-10-02T23:01:17.794778353Z","provider":"osv","upstream":["GHSA-c2m8-h5v5-343r"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32","https://github.com/tornadoweb/tornado/commit/f9f50b8bab265a2abf9f2415a3d2da6264a5450b","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f8e22834-64da-43e7-8099-3e22b89ee505","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7cxp-9fw7-m43f","advisory_id":"f8e22834-64da-43e7-8099-3e22b89ee505","event_types":["advisory"],"published_at":"2026-10-25T23:29:14.378734+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:40+00:00","detail_url":"/events/72127"},"members":[{"id":72127,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7cxp-9fw7-m43f","summary":"CGA-7cxp-9fw7-m43f","evidence":"osv:CGA-7cxp-9fw7-m43f","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7cxp-9fw7-m43f","aliases":["CGA-7cxp-9fw7-m43f"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7cxp-9fw7-m43f.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:18Z"}]}}],"modified":"2026-10-02T23:01:17.794778353Z","provider":"osv","upstream":["GHSA-c2m8-h5v5-343r"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32","https://github.com/tornadoweb/tornado/commit/f9f50b8bab265a2abf9f2415a3d2da6264a5450b","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f8e22834-64da-43e7-8099-3e22b89ee505","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7cxp-9fw7-m43f","advisory_id":"f8e22834-64da-43e7-8099-3e22b89ee505","event_types":["advisory"],"published_at":"2026-10-25T23:29:14.378734+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:40+00:00","detail_url":"/events/72127"}]}},{"id":71567,"cve_ids":["CVE-2026-101898"],"payload":{"kind":"advisory","title":"CGA-5h3v-qvhw-wc2r","summary":"CGA-5h3v-qvhw-wc2r","evidence":"osv:CGA-5h3v-qvhw-wc2r","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5h3v-qvhw-wc2r","aliases":["CGA-5h3v-qvhw-wc2r"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5h3v-qvhw-wc2r.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:01:06.152380341Z","provider":"osv","upstream":["CVE-2026-101898","GHSA-3pq3-5fj3-cg6v"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101898.json","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101898","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6477ae06-4377-480b-9baf-f2642038191a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101898","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101898","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101898","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5h3v-qvhw-wc2r","advisory_id":"6477ae06-4377-480b-9baf-f2642038191a","event_types":["advisory"],"published_at":"2026-10-25T23:19:49.351231+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:35+00:00","detail_url":"/advisories/advisory%3A6477ae06-4377-480b-9baf-f2642038191a","group":{"id":"advisory:6477ae06-4377-480b-9baf-f2642038191a","revision":1,"primary_event_id":71984,"change":"published","superseded_by":[],"changed":{"id":71984,"cve_ids":["CVE-2026-101898"],"payload":{"kind":"advisory","title":"CGA-5h3v-qvhw-wc2r","summary":"CGA-5h3v-qvhw-wc2r","evidence":"osv:CGA-5h3v-qvhw-wc2r","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5h3v-qvhw-wc2r","aliases":["CGA-5h3v-qvhw-wc2r"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5h3v-qvhw-wc2r.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:01:06.152380341Z","provider":"osv","upstream":["CVE-2026-101898","GHSA-3pq3-5fj3-cg6v"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101898.json","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101898","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6477ae06-4377-480b-9baf-f2642038191a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101898","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101898","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101898","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5h3v-qvhw-wc2r","advisory_id":"6477ae06-4377-480b-9baf-f2642038191a","event_types":["advisory"],"published_at":"2026-10-25T23:19:49.351231+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:35+00:00","detail_url":"/events/71984"},"members":[{"id":71984,"cve_ids":["CVE-2026-101898"],"payload":{"kind":"advisory","title":"CGA-5h3v-qvhw-wc2r","summary":"CGA-5h3v-qvhw-wc2r","evidence":"osv:CGA-5h3v-qvhw-wc2r","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5h3v-qvhw-wc2r","aliases":["CGA-5h3v-qvhw-wc2r"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5h3v-qvhw-wc2r.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:01:06.152380341Z","provider":"osv","upstream":["CVE-2026-101898","GHSA-3pq3-5fj3-cg6v"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101898.json","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101898","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6477ae06-4377-480b-9baf-f2642038191a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101898","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101898","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101898","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5h3v-qvhw-wc2r","advisory_id":"6477ae06-4377-480b-9baf-f2642038191a","event_types":["advisory"],"published_at":"2026-10-25T23:19:49.351231+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:35+00:00","detail_url":"/events/71984"}]}},{"id":71511,"cve_ids":["CVE-2026-44431"],"payload":{"kind":"advisory","title":"CGA-m4vv-x5m8-4x3x","summary":"CGA-m4vv-x5m8-4x3x","evidence":"osv:CGA-m4vv-x5m8-4x3x","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m4vv-x5m8-4x3x","aliases":["CGA-m4vv-x5m8-4x3x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m4vv-x5m8-4x3x.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:12Z"}]}}],"modified":"2026-10-02T23:01:01.455035779Z","provider":"osv","upstream":["CVE-2026-44431","GHSA-qccp-gfcp-xxvc"],"references":["https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44431.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","https://nvd.nist.gov/vuln/detail/CVE-2026-44431"]},"related_cves":[{"value":"CVE-2026-44431","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:16171066-4071-45d8-99a1-6e08a0f739c1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m4vv-x5m8-4x3x","advisory_id":"16171066-4071-45d8-99a1-6e08a0f739c1","event_types":["advisory"],"published_at":"2026-10-25T23:15:49.922198+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-13T00:28:58+00:00","detail_url":"/advisories/advisory%3A16171066-4071-45d8-99a1-6e08a0f739c1","group":{"id":"advisory:16171066-4071-45d8-99a1-6e08a0f739c1","revision":1,"primary_event_id":71921,"change":"published","superseded_by":[],"changed":{"id":71921,"cve_ids":["CVE-2026-44431"],"payload":{"kind":"advisory","title":"CGA-m4vv-x5m8-4x3x","summary":"CGA-m4vv-x5m8-4x3x","evidence":"osv:CGA-m4vv-x5m8-4x3x","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m4vv-x5m8-4x3x","aliases":["CGA-m4vv-x5m8-4x3x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m4vv-x5m8-4x3x.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:12Z"}]}}],"modified":"2026-10-02T23:01:01.455035779Z","provider":"osv","upstream":["CVE-2026-44431","GHSA-qccp-gfcp-xxvc"],"references":["https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44431.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","https://nvd.nist.gov/vuln/detail/CVE-2026-44431"]},"related_cves":[{"value":"CVE-2026-44431","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:16171066-4071-45d8-99a1-6e08a0f739c1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m4vv-x5m8-4x3x","advisory_id":"16171066-4071-45d8-99a1-6e08a0f739c1","event_types":["advisory"],"published_at":"2026-10-25T23:15:49.922198+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-13T00:28:58+00:00","detail_url":"/events/71921"},"members":[{"id":71921,"cve_ids":["CVE-2026-44431"],"payload":{"kind":"advisory","title":"CGA-m4vv-x5m8-4x3x","summary":"CGA-m4vv-x5m8-4x3x","evidence":"osv:CGA-m4vv-x5m8-4x3x","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m4vv-x5m8-4x3x","aliases":["CGA-m4vv-x5m8-4x3x"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m4vv-x5m8-4x3x.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:12Z"}]}}],"modified":"2026-10-02T23:01:01.455035779Z","provider":"osv","upstream":["CVE-2026-44431","GHSA-qccp-gfcp-xxvc"],"references":["https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44431.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","https://nvd.nist.gov/vuln/detail/CVE-2026-44431"]},"related_cves":[{"value":"CVE-2026-44431","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:16171066-4071-45d8-99a1-6e08a0f739c1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m4vv-x5m8-4x3x","advisory_id":"16171066-4071-45d8-99a1-6e08a0f739c1","event_types":["advisory"],"published_at":"2026-10-25T23:15:49.922198+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-13T00:28:58+00:00","detail_url":"/events/71921"}]}},{"id":71493,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-wgv5-6qx3-5jwp","summary":"CGA-wgv5-6qx3-5jwp","evidence":"osv:CGA-wgv5-6qx3-5jwp","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wgv5-6qx3-5jwp","aliases":["CGA-wgv5-6qx3-5jwp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wgv5-6qx3-5jwp.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:59.192902791Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d36a79bb-7ff4-417f-ab46-ad60d22a200a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wgv5-6qx3-5jwp","advisory_id":"d36a79bb-7ff4-417f-ab46-ad60d22a200a","event_types":["advisory"],"published_at":"2026-10-25T23:14:19.440198+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:37+00:00","detail_url":"/advisories/advisory%3Ad36a79bb-7ff4-417f-ab46-ad60d22a200a","group":{"id":"advisory:d36a79bb-7ff4-417f-ab46-ad60d22a200a","revision":1,"primary_event_id":71900,"change":"published","superseded_by":[],"changed":{"id":71900,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-wgv5-6qx3-5jwp","summary":"CGA-wgv5-6qx3-5jwp","evidence":"osv:CGA-wgv5-6qx3-5jwp","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wgv5-6qx3-5jwp","aliases":["CGA-wgv5-6qx3-5jwp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wgv5-6qx3-5jwp.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:59.192902791Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d36a79bb-7ff4-417f-ab46-ad60d22a200a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wgv5-6qx3-5jwp","advisory_id":"d36a79bb-7ff4-417f-ab46-ad60d22a200a","event_types":["advisory"],"published_at":"2026-10-25T23:14:19.440198+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:37+00:00","detail_url":"/events/71900"},"members":[{"id":71900,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-wgv5-6qx3-5jwp","summary":"CGA-wgv5-6qx3-5jwp","evidence":"osv:CGA-wgv5-6qx3-5jwp","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wgv5-6qx3-5jwp","aliases":["CGA-wgv5-6qx3-5jwp"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wgv5-6qx3-5jwp.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:59.192902791Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d36a79bb-7ff4-417f-ab46-ad60d22a200a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wgv5-6qx3-5jwp","advisory_id":"d36a79bb-7ff4-417f-ab46-ad60d22a200a","event_types":["advisory"],"published_at":"2026-10-25T23:14:19.440198+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:37+00:00","detail_url":"/events/71900"}]}},{"id":71417,"cve_ids":["CVE-2026-101901"],"payload":{"kind":"advisory","title":"CGA-hm54-hm6j-xqg8","summary":"CGA-hm54-hm6j-xqg8","evidence":"osv:CGA-hm54-hm6j-xqg8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-hm54-hm6j-xqg8","aliases":["CGA-hm54-hm6j-xqg8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hm54-hm6j-xqg8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:00:50.070546443Z","provider":"osv","upstream":["CVE-2026-101901","GHSA-542g-h47m-68v8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101901.json","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101901","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6c0b8580-a9d7-4d08-ae35-47439ccac877","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hm54-hm6j-xqg8","advisory_id":"6c0b8580-a9d7-4d08-ae35-47439ccac877","event_types":["advisory"],"published_at":"2026-10-25T23:08:32.654233+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:36+00:00","detail_url":"/advisories/advisory%3A6c0b8580-a9d7-4d08-ae35-47439ccac877","group":{"id":"advisory:6c0b8580-a9d7-4d08-ae35-47439ccac877","revision":1,"primary_event_id":71809,"change":"published","superseded_by":[],"changed":{"id":71809,"cve_ids":["CVE-2026-101901"],"payload":{"kind":"advisory","title":"CGA-hm54-hm6j-xqg8","summary":"CGA-hm54-hm6j-xqg8","evidence":"osv:CGA-hm54-hm6j-xqg8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-hm54-hm6j-xqg8","aliases":["CGA-hm54-hm6j-xqg8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hm54-hm6j-xqg8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:00:50.070546443Z","provider":"osv","upstream":["CVE-2026-101901","GHSA-542g-h47m-68v8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101901.json","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101901","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6c0b8580-a9d7-4d08-ae35-47439ccac877","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hm54-hm6j-xqg8","advisory_id":"6c0b8580-a9d7-4d08-ae35-47439ccac877","event_types":["advisory"],"published_at":"2026-10-25T23:08:32.654233+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:36+00:00","detail_url":"/events/71809"},"members":[{"id":71809,"cve_ids":["CVE-2026-101901"],"payload":{"kind":"advisory","title":"CGA-hm54-hm6j-xqg8","summary":"CGA-hm54-hm6j-xqg8","evidence":"osv:CGA-hm54-hm6j-xqg8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-hm54-hm6j-xqg8","aliases":["CGA-hm54-hm6j-xqg8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hm54-hm6j-xqg8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:00:50.070546443Z","provider":"osv","upstream":["CVE-2026-101901","GHSA-542g-h47m-68v8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101901.json","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101901","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6c0b8580-a9d7-4d08-ae35-47439ccac877","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hm54-hm6j-xqg8","advisory_id":"6c0b8580-a9d7-4d08-ae35-47439ccac877","event_types":["advisory"],"published_at":"2026-10-25T23:08:32.654233+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:36+00:00","detail_url":"/events/71809"}]}},{"id":71386,"cve_ids":["CVE-2026-44432"],"payload":{"kind":"advisory","title":"CGA-fg6j-5wc3-p3wh","summary":"CGA-fg6j-5wc3-p3wh","evidence":"osv:CGA-fg6j-5wc3-p3wh","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fg6j-5wc3-p3wh","aliases":["CGA-fg6j-5wc3-p3wh"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fg6j-5wc3-p3wh.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:12Z"}]}}],"modified":"2026-10-02T23:00:47.256571306Z","provider":"osv","upstream":["CVE-2026-44432","GHSA-mf9v-mfxr-j63j"],"references":["https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json","https://access.redhat.com/errata/RHSA-2026:15862","https://access.redhat.com/errata/RHSA-2026:20338","https://access.redhat.com/errata/RHSA-2026:22934","https://access.redhat.com/errata/RHSA-2026:24000","https://access.redhat.com/errata/RHSA-2026:24009","https://access.redhat.com/errata/RHSA-2026:24014","https://access.redhat.com/errata/RHSA-2026:24069","https://access.redhat.com/errata/RHSA-2026:24374","https://access.redhat.com/errata/RHSA-2026:24476","https://access.redhat.com/errata/RHSA-2026:24483","https://access.redhat.com/errata/RHSA-2026:24540","https://access.redhat.com/errata/RHSA-2026:24541","https://access.redhat.com/errata/RHSA-2026:24542","https://access.redhat.com/errata/RHSA-2026:24544","https://access.redhat.com/errata/RHSA-2026:25039","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25928","https://access.redhat.com/errata/RHSA-2026:26212","https://access.redhat.com/errata/RHSA-2026:26304","https://access.redhat.com/errata/RHSA-2026:27929","https://access.redhat.com/errata/RHSA-2026:28000","https://access.redhat.com/errata/RHSA-2026:28157","https://access.redhat.com/errata/RHSA-2026:28158","https://access.redhat.com/errata/RHSA-2026:28159","https://access.redhat.com/errata/RHSA-2026:28571","https://access.redhat.com/errata/RHSA-2026:30076","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:32992","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:33683","https://access.redhat.com/errata/RHSA-2026:34160","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34526","https://access.redhat.com/errata/RHSA-2026:34531","https://access.redhat.com/errata/RHSA-2026:34533","https://access.redhat.com/errata/RHSA-2026:34607","https://access.redhat.com/errata/RHSA-2026:7625","https://access.redhat.com/errata/RHSA-2026:7634","https://access.redhat.com/security/cve/CVE-2026-44432","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44432.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j","https://nvd.nist.gov/vuln/detail/CVE-2026-44432","https://bugzilla.redhat.com/show_bug.cgi?id=2477154","https://access.redhat.com/errata/RHSA-2026:36350","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42144","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:51206","https://access.redhat.com/errata/RHSA-2026:56347","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59409","https://access.redhat.com/errata/RHSA-2026:60362","https://access.redhat.com/errata/RHSA-2026:60371"]},"related_cves":[{"value":"CVE-2026-44432","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3774820c-a911-4c8e-82b9-b09f75e4cb10","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fg6j-5wc3-p3wh","advisory_id":"3774820c-a911-4c8e-82b9-b09f75e4cb10","event_types":["advisory"],"published_at":"2026-10-25T23:07:26.236971+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-13T00:28:58+00:00","detail_url":"/advisories/advisory%3A3774820c-a911-4c8e-82b9-b09f75e4cb10","group":{"id":"advisory:3774820c-a911-4c8e-82b9-b09f75e4cb10","revision":1,"primary_event_id":71777,"change":"published","superseded_by":[],"changed":{"id":71777,"cve_ids":["CVE-2026-44432"],"payload":{"kind":"advisory","title":"CGA-fg6j-5wc3-p3wh","summary":"CGA-fg6j-5wc3-p3wh","evidence":"osv:CGA-fg6j-5wc3-p3wh","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fg6j-5wc3-p3wh","aliases":["CGA-fg6j-5wc3-p3wh"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fg6j-5wc3-p3wh.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:12Z"}]}}],"modified":"2026-10-02T23:00:47.256571306Z","provider":"osv","upstream":["CVE-2026-44432","GHSA-mf9v-mfxr-j63j"],"references":["https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json","https://access.redhat.com/errata/RHSA-2026:15862","https://access.redhat.com/errata/RHSA-2026:20338","https://access.redhat.com/errata/RHSA-2026:22934","https://access.redhat.com/errata/RHSA-2026:24000","https://access.redhat.com/errata/RHSA-2026:24009","https://access.redhat.com/errata/RHSA-2026:24014","https://access.redhat.com/errata/RHSA-2026:24069","https://access.redhat.com/errata/RHSA-2026:24374","https://access.redhat.com/errata/RHSA-2026:24476","https://access.redhat.com/errata/RHSA-2026:24483","https://access.redhat.com/errata/RHSA-2026:24540","https://access.redhat.com/errata/RHSA-2026:24541","https://access.redhat.com/errata/RHSA-2026:24542","https://access.redhat.com/errata/RHSA-2026:24544","https://access.redhat.com/errata/RHSA-2026:25039","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25928","https://access.redhat.com/errata/RHSA-2026:26212","https://access.redhat.com/errata/RHSA-2026:26304","https://access.redhat.com/errata/RHSA-2026:27929","https://access.redhat.com/errata/RHSA-2026:28000","https://access.redhat.com/errata/RHSA-2026:28157","https://access.redhat.com/errata/RHSA-2026:28158","https://access.redhat.com/errata/RHSA-2026:28159","https://access.redhat.com/errata/RHSA-2026:28571","https://access.redhat.com/errata/RHSA-2026:30076","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:32992","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:33683","https://access.redhat.com/errata/RHSA-2026:34160","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34526","https://access.redhat.com/errata/RHSA-2026:34531","https://access.redhat.com/errata/RHSA-2026:34533","https://access.redhat.com/errata/RHSA-2026:34607","https://access.redhat.com/errata/RHSA-2026:7625","https://access.redhat.com/errata/RHSA-2026:7634","https://access.redhat.com/security/cve/CVE-2026-44432","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44432.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j","https://nvd.nist.gov/vuln/detail/CVE-2026-44432","https://bugzilla.redhat.com/show_bug.cgi?id=2477154","https://access.redhat.com/errata/RHSA-2026:36350","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42144","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:51206","https://access.redhat.com/errata/RHSA-2026:56347","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59409","https://access.redhat.com/errata/RHSA-2026:60362","https://access.redhat.com/errata/RHSA-2026:60371"]},"related_cves":[{"value":"CVE-2026-44432","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3774820c-a911-4c8e-82b9-b09f75e4cb10","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fg6j-5wc3-p3wh","advisory_id":"3774820c-a911-4c8e-82b9-b09f75e4cb10","event_types":["advisory"],"published_at":"2026-10-25T23:07:26.236971+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-13T00:28:58+00:00","detail_url":"/events/71777"},"members":[{"id":71777,"cve_ids":["CVE-2026-44432"],"payload":{"kind":"advisory","title":"CGA-fg6j-5wc3-p3wh","summary":"CGA-fg6j-5wc3-p3wh","evidence":"osv:CGA-fg6j-5wc3-p3wh","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-fg6j-5wc3-p3wh","aliases":["CGA-fg6j-5wc3-p3wh"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fg6j-5wc3-p3wh.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:12Z"}]}}],"modified":"2026-10-02T23:00:47.256571306Z","provider":"osv","upstream":["CVE-2026-44432","GHSA-mf9v-mfxr-j63j"],"references":["https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json","https://access.redhat.com/errata/RHSA-2026:15862","https://access.redhat.com/errata/RHSA-2026:20338","https://access.redhat.com/errata/RHSA-2026:22934","https://access.redhat.com/errata/RHSA-2026:24000","https://access.redhat.com/errata/RHSA-2026:24009","https://access.redhat.com/errata/RHSA-2026:24014","https://access.redhat.com/errata/RHSA-2026:24069","https://access.redhat.com/errata/RHSA-2026:24374","https://access.redhat.com/errata/RHSA-2026:24476","https://access.redhat.com/errata/RHSA-2026:24483","https://access.redhat.com/errata/RHSA-2026:24540","https://access.redhat.com/errata/RHSA-2026:24541","https://access.redhat.com/errata/RHSA-2026:24542","https://access.redhat.com/errata/RHSA-2026:24544","https://access.redhat.com/errata/RHSA-2026:25039","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25928","https://access.redhat.com/errata/RHSA-2026:26212","https://access.redhat.com/errata/RHSA-2026:26304","https://access.redhat.com/errata/RHSA-2026:27929","https://access.redhat.com/errata/RHSA-2026:28000","https://access.redhat.com/errata/RHSA-2026:28157","https://access.redhat.com/errata/RHSA-2026:28158","https://access.redhat.com/errata/RHSA-2026:28159","https://access.redhat.com/errata/RHSA-2026:28571","https://access.redhat.com/errata/RHSA-2026:30076","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:32992","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:33683","https://access.redhat.com/errata/RHSA-2026:34160","https://access.redhat.com/errata/RHSA-2026:34374","https://access.redhat.com/errata/RHSA-2026:34526","https://access.redhat.com/errata/RHSA-2026:34531","https://access.redhat.com/errata/RHSA-2026:34533","https://access.redhat.com/errata/RHSA-2026:34607","https://access.redhat.com/errata/RHSA-2026:7625","https://access.redhat.com/errata/RHSA-2026:7634","https://access.redhat.com/security/cve/CVE-2026-44432","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44432.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j","https://nvd.nist.gov/vuln/detail/CVE-2026-44432","https://bugzilla.redhat.com/show_bug.cgi?id=2477154","https://access.redhat.com/errata/RHSA-2026:36350","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42144","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:51206","https://access.redhat.com/errata/RHSA-2026:56347","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59409","https://access.redhat.com/errata/RHSA-2026:60362","https://access.redhat.com/errata/RHSA-2026:60371"]},"related_cves":[{"value":"CVE-2026-44432","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3774820c-a911-4c8e-82b9-b09f75e4cb10","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fg6j-5wc3-p3wh","advisory_id":"3774820c-a911-4c8e-82b9-b09f75e4cb10","event_types":["advisory"],"published_at":"2026-10-25T23:07:26.236971+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-13T00:28:58+00:00","detail_url":"/events/71777"}]}},{"id":71349,"cve_ids":["CVE-2026-101904"],"payload":{"kind":"advisory","title":"CGA-ch49-p8p2-fj39","summary":"CGA-ch49-p8p2-fj39","evidence":"osv:CGA-ch49-p8p2-fj39","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-ch49-p8p2-fj39","aliases":["CGA-ch49-p8p2-fj39"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ch49-p8p2-fj39.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:00:43.576975406Z","provider":"osv","upstream":["CVE-2026-101904","GHSA-j8rh-479h-cp32"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101904.json","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101904","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:41bb2e27-b2e6-47bc-b81b-1e7e27577fe9","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101904","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101904","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ch49-p8p2-fj39","advisory_id":"41bb2e27-b2e6-47bc-b81b-1e7e27577fe9","event_types":["advisory"],"published_at":"2026-10-25T23:04:11.136337+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:37+00:00","detail_url":"/advisories/advisory%3A41bb2e27-b2e6-47bc-b81b-1e7e27577fe9","group":{"id":"advisory:41bb2e27-b2e6-47bc-b81b-1e7e27577fe9","revision":1,"primary_event_id":71740,"change":"published","superseded_by":[],"changed":{"id":71740,"cve_ids":["CVE-2026-101904"],"payload":{"kind":"advisory","title":"CGA-ch49-p8p2-fj39","summary":"CGA-ch49-p8p2-fj39","evidence":"osv:CGA-ch49-p8p2-fj39","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-ch49-p8p2-fj39","aliases":["CGA-ch49-p8p2-fj39"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ch49-p8p2-fj39.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:00:43.576975406Z","provider":"osv","upstream":["CVE-2026-101904","GHSA-j8rh-479h-cp32"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101904.json","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101904","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:41bb2e27-b2e6-47bc-b81b-1e7e27577fe9","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101904","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101904","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ch49-p8p2-fj39","advisory_id":"41bb2e27-b2e6-47bc-b81b-1e7e27577fe9","event_types":["advisory"],"published_at":"2026-10-25T23:04:11.136337+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:37+00:00","detail_url":"/events/71740"},"members":[{"id":71740,"cve_ids":["CVE-2026-101904"],"payload":{"kind":"advisory","title":"CGA-ch49-p8p2-fj39","summary":"CGA-ch49-p8p2-fj39","evidence":"osv:CGA-ch49-p8p2-fj39","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-ch49-p8p2-fj39","aliases":["CGA-ch49-p8p2-fj39"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-ch49-p8p2-fj39.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:16Z"}]}}],"modified":"2026-10-02T23:00:43.576975406Z","provider":"osv","upstream":["CVE-2026-101904","GHSA-j8rh-479h-cp32"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101904.json","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101904","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:41bb2e27-b2e6-47bc-b81b-1e7e27577fe9","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101904","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101904","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-ch49-p8p2-fj39","advisory_id":"41bb2e27-b2e6-47bc-b81b-1e7e27577fe9","event_types":["advisory"],"published_at":"2026-10-25T23:04:11.136337+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:37+00:00","detail_url":"/events/71740"}]}},{"id":71304,"cve_ids":["CVE-2026-101908"],"payload":{"kind":"advisory","title":"CGA-7x82-frwg-qvmv","summary":"CGA-7x82-frwg-qvmv","evidence":"osv:CGA-7x82-frwg-qvmv","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7x82-frwg-qvmv","aliases":["CGA-7x82-frwg-qvmv"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7x82-frwg-qvmv.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:39.546616303Z","provider":"osv","upstream":["CVE-2026-101908","GHSA-vh66-26gq-q6x8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101908.json","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101908","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:73d80caa-ba6a-47b0-944a-6d35b72de637","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101908","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101908","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7x82-frwg-qvmv","advisory_id":"73d80caa-ba6a-47b0-944a-6d35b72de637","event_types":["advisory"],"published_at":"2026-10-25T23:01:59.214573+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:38+00:00","detail_url":"/advisories/advisory%3A73d80caa-ba6a-47b0-944a-6d35b72de637","group":{"id":"advisory:73d80caa-ba6a-47b0-944a-6d35b72de637","revision":1,"primary_event_id":71693,"change":"published","superseded_by":[],"changed":{"id":71693,"cve_ids":["CVE-2026-101908"],"payload":{"kind":"advisory","title":"CGA-7x82-frwg-qvmv","summary":"CGA-7x82-frwg-qvmv","evidence":"osv:CGA-7x82-frwg-qvmv","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7x82-frwg-qvmv","aliases":["CGA-7x82-frwg-qvmv"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7x82-frwg-qvmv.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:39.546616303Z","provider":"osv","upstream":["CVE-2026-101908","GHSA-vh66-26gq-q6x8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101908.json","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101908","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:73d80caa-ba6a-47b0-944a-6d35b72de637","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101908","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101908","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7x82-frwg-qvmv","advisory_id":"73d80caa-ba6a-47b0-944a-6d35b72de637","event_types":["advisory"],"published_at":"2026-10-25T23:01:59.214573+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:38+00:00","detail_url":"/events/71693"},"members":[{"id":71693,"cve_ids":["CVE-2026-101908"],"payload":{"kind":"advisory","title":"CGA-7x82-frwg-qvmv","summary":"CGA-7x82-frwg-qvmv","evidence":"osv:CGA-7x82-frwg-qvmv","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7x82-frwg-qvmv","aliases":["CGA-7x82-frwg-qvmv"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7x82-frwg-qvmv.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:39.546616303Z","provider":"osv","upstream":["CVE-2026-101908","GHSA-vh66-26gq-q6x8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101908.json","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101908","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:73d80caa-ba6a-47b0-944a-6d35b72de637","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101908","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101908","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7x82-frwg-qvmv","advisory_id":"73d80caa-ba6a-47b0-944a-6d35b72de637","event_types":["advisory"],"published_at":"2026-10-25T23:01:59.214573+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:38+00:00","detail_url":"/events/71693"}]}},{"id":71273,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5cxh-ppwm-rhv8","summary":"CGA-5cxh-ppwm-rhv8","evidence":"osv:CGA-5cxh-ppwm-rhv8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5cxh-ppwm-rhv8","aliases":["CGA-5cxh-ppwm-rhv8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5cxh-ppwm-rhv8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/opt/airflow/lib/python3.12/site-packages/ray/jars/ray_dist.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:15Z"}]}}],"modified":"2026-10-02T23:00:35.689215293Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:04b7f434-1869-49c8-b846-4bdb8bee3789","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5cxh-ppwm-rhv8","advisory_id":"04b7f434-1869-49c8-b846-4bdb8bee3789","event_types":["advisory"],"published_at":"2026-10-25T23:00:17.520872+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:34+00:00","detail_url":"/advisories/advisory%3A04b7f434-1869-49c8-b846-4bdb8bee3789","group":{"id":"advisory:04b7f434-1869-49c8-b846-4bdb8bee3789","revision":1,"primary_event_id":71659,"change":"published","superseded_by":[],"changed":{"id":71659,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5cxh-ppwm-rhv8","summary":"CGA-5cxh-ppwm-rhv8","evidence":"osv:CGA-5cxh-ppwm-rhv8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5cxh-ppwm-rhv8","aliases":["CGA-5cxh-ppwm-rhv8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5cxh-ppwm-rhv8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/opt/airflow/lib/python3.12/site-packages/ray/jars/ray_dist.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:15Z"}]}}],"modified":"2026-10-02T23:00:35.689215293Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:04b7f434-1869-49c8-b846-4bdb8bee3789","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5cxh-ppwm-rhv8","advisory_id":"04b7f434-1869-49c8-b846-4bdb8bee3789","event_types":["advisory"],"published_at":"2026-10-25T23:00:17.520872+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:34+00:00","detail_url":"/events/71659"},"members":[{"id":71659,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-5cxh-ppwm-rhv8","summary":"CGA-5cxh-ppwm-rhv8","evidence":"osv:CGA-5cxh-ppwm-rhv8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5cxh-ppwm-rhv8","aliases":["CGA-5cxh-ppwm-rhv8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5cxh-ppwm-rhv8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/opt/airflow/lib/python3.12/site-packages/ray/jars/ray_dist.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:15Z"}]}}],"modified":"2026-10-02T23:00:35.689215293Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:04b7f434-1869-49c8-b846-4bdb8bee3789","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5cxh-ppwm-rhv8","advisory_id":"04b7f434-1869-49c8-b846-4bdb8bee3789","event_types":["advisory"],"published_at":"2026-10-25T23:00:17.520872+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:34+00:00","detail_url":"/events/71659"}]}},{"id":71229,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-jj6c-hv32-c4p6","summary":"CGA-jj6c-hv32-c4p6","evidence":"osv:CGA-jj6c-hv32-c4p6","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-jj6c-hv32-c4p6","aliases":["CGA-jj6c-hv32-c4p6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jj6c-hv32-c4p6.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:31.144139736Z","provider":"osv","upstream":["GHSA-chx6-46f5-w4vp"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/15f056080d8e456f92cca8ad0c33e5a5480414ac","https://github.com/tornadoweb/tornado/commit/6564e0a0922c16f239d3a18adccd04736e380c89","https://github.com/tornadoweb/tornado/commit/aa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4","https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:535f8ca6-ef9b-4488-9af6-5b05004dbd4d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jj6c-hv32-c4p6","advisory_id":"535f8ca6-ef9b-4488-9af6-5b05004dbd4d","event_types":["advisory"],"published_at":"2026-10-25T22:57:27.844127+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:40+00:00","detail_url":"/advisories/advisory%3A535f8ca6-ef9b-4488-9af6-5b05004dbd4d","group":{"id":"advisory:535f8ca6-ef9b-4488-9af6-5b05004dbd4d","revision":1,"primary_event_id":71614,"change":"published","superseded_by":[],"changed":{"id":71614,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-jj6c-hv32-c4p6","summary":"CGA-jj6c-hv32-c4p6","evidence":"osv:CGA-jj6c-hv32-c4p6","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-jj6c-hv32-c4p6","aliases":["CGA-jj6c-hv32-c4p6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jj6c-hv32-c4p6.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:31.144139736Z","provider":"osv","upstream":["GHSA-chx6-46f5-w4vp"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/15f056080d8e456f92cca8ad0c33e5a5480414ac","https://github.com/tornadoweb/tornado/commit/6564e0a0922c16f239d3a18adccd04736e380c89","https://github.com/tornadoweb/tornado/commit/aa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4","https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:535f8ca6-ef9b-4488-9af6-5b05004dbd4d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jj6c-hv32-c4p6","advisory_id":"535f8ca6-ef9b-4488-9af6-5b05004dbd4d","event_types":["advisory"],"published_at":"2026-10-25T22:57:27.844127+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:40+00:00","detail_url":"/events/71614"},"members":[{"id":71614,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-jj6c-hv32-c4p6","summary":"CGA-jj6c-hv32-c4p6","evidence":"osv:CGA-jj6c-hv32-c4p6","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-jj6c-hv32-c4p6","aliases":["CGA-jj6c-hv32-c4p6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jj6c-hv32-c4p6.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:17Z"}]}}],"modified":"2026-10-02T23:00:31.144139736Z","provider":"osv","upstream":["GHSA-chx6-46f5-w4vp"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/15f056080d8e456f92cca8ad0c33e5a5480414ac","https://github.com/tornadoweb/tornado/commit/6564e0a0922c16f239d3a18adccd04736e380c89","https://github.com/tornadoweb/tornado/commit/aa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4","https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:535f8ca6-ef9b-4488-9af6-5b05004dbd4d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jj6c-hv32-c4p6","advisory_id":"535f8ca6-ef9b-4488-9af6-5b05004dbd4d","event_types":["advisory"],"published_at":"2026-10-25T22:57:27.844127+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:40+00:00","detail_url":"/events/71614"}]}},{"id":71206,"cve_ids":["CVE-2026-84377"],"payload":{"kind":"advisory","title":"CGA-9gp2-gx2g-8rh4","summary":"CGA-9gp2-gx2g-8rh4","evidence":"osv:CGA-9gp2-gx2g-8rh4","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9gp2-gx2g-8rh4","aliases":["CGA-9gp2-gx2g-8rh4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9gp2-gx2g-8rh4.json"},"ecosystem_specific":{"components":[{"component_name":"litellm","component_purl":"pkg:pypi/litellm@1.84.0","component_type":"python","component_version":"1.84.0","component_location":"/opt/airflow/lib/python3.12/site-packages/litellm-1.84.0.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:18Z"}]}}],"modified":"2026-10-02T23:00:29.101609305Z","provider":"osv","upstream":["CVE-2026-84377","GHSA-3cv6-jpf6-8222"],"references":["https://github.com/BerriAI/litellm/releases/tag/v1.88.6","https://github.com/BerriAI/litellm/releases/tag/v1.96.2","https://github.com/BerriAI/litellm/security/advisories/GHSA-3cv6-jpf6-8222","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84377.json","https://nvd.nist.gov/vuln/detail/CVE-2026-84377","https://github.com/BerriAI/litellm/commit/473f72e63a9777d793fbbf57194d8ec4fb97bc1b","https://github.com/BerriAI/litellm/commit/820f247a6abba55cd87d130bef7bba7be3b29d37","https://github.com/BerriAI/litellm/commit/c898d341c02299cf2506d0d8e84cc67953043593","https://github.com/BerriAI/litellm/pull/36011","https://github.com/BerriAI/litellm/pull/36314","https://github.com/BerriAI/litellm/pull/36494"]},"related_cves":[{"value":"CVE-2026-84377","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:78bc32f6-081a-4d5d-b20c-951397a1ca0c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9gp2-gx2g-8rh4","advisory_id":"78bc32f6-081a-4d5d-b20c-951397a1ca0c","event_types":["advisory"],"published_at":"2026-10-25T22:56:26.685839+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:38+00:00","detail_url":"/advisories/advisory%3A78bc32f6-081a-4d5d-b20c-951397a1ca0c","group":{"id":"advisory:78bc32f6-081a-4d5d-b20c-951397a1ca0c","revision":1,"primary_event_id":71591,"change":"published","superseded_by":[],"changed":{"id":71591,"cve_ids":["CVE-2026-84377"],"payload":{"kind":"advisory","title":"CGA-9gp2-gx2g-8rh4","summary":"CGA-9gp2-gx2g-8rh4","evidence":"osv:CGA-9gp2-gx2g-8rh4","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9gp2-gx2g-8rh4","aliases":["CGA-9gp2-gx2g-8rh4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9gp2-gx2g-8rh4.json"},"ecosystem_specific":{"components":[{"component_name":"litellm","component_purl":"pkg:pypi/litellm@1.84.0","component_type":"python","component_version":"1.84.0","component_location":"/opt/airflow/lib/python3.12/site-packages/litellm-1.84.0.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:18Z"}]}}],"modified":"2026-10-02T23:00:29.101609305Z","provider":"osv","upstream":["CVE-2026-84377","GHSA-3cv6-jpf6-8222"],"references":["https://github.com/BerriAI/litellm/releases/tag/v1.88.6","https://github.com/BerriAI/litellm/releases/tag/v1.96.2","https://github.com/BerriAI/litellm/security/advisories/GHSA-3cv6-jpf6-8222","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84377.json","https://nvd.nist.gov/vuln/detail/CVE-2026-84377","https://github.com/BerriAI/litellm/commit/473f72e63a9777d793fbbf57194d8ec4fb97bc1b","https://github.com/BerriAI/litellm/commit/820f247a6abba55cd87d130bef7bba7be3b29d37","https://github.com/BerriAI/litellm/commit/c898d341c02299cf2506d0d8e84cc67953043593","https://github.com/BerriAI/litellm/pull/36011","https://github.com/BerriAI/litellm/pull/36314","https://github.com/BerriAI/litellm/pull/36494"]},"related_cves":[{"value":"CVE-2026-84377","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:78bc32f6-081a-4d5d-b20c-951397a1ca0c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9gp2-gx2g-8rh4","advisory_id":"78bc32f6-081a-4d5d-b20c-951397a1ca0c","event_types":["advisory"],"published_at":"2026-10-25T22:56:26.685839+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:38+00:00","detail_url":"/events/71591"},"members":[{"id":71591,"cve_ids":["CVE-2026-84377"],"payload":{"kind":"advisory","title":"CGA-9gp2-gx2g-8rh4","summary":"CGA-9gp2-gx2g-8rh4","evidence":"osv:CGA-9gp2-gx2g-8rh4","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9gp2-gx2g-8rh4","aliases":["CGA-9gp2-gx2g-8rh4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9gp2-gx2g-8rh4.json"},"ecosystem_specific":{"components":[{"component_name":"litellm","component_purl":"pkg:pypi/litellm@1.84.0","component_type":"python","component_version":"1.84.0","component_location":"/opt/airflow/lib/python3.12/site-packages/litellm-1.84.0.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:18Z"}]}}],"modified":"2026-10-02T23:00:29.101609305Z","provider":"osv","upstream":["CVE-2026-84377","GHSA-3cv6-jpf6-8222"],"references":["https://github.com/BerriAI/litellm/releases/tag/v1.88.6","https://github.com/BerriAI/litellm/releases/tag/v1.96.2","https://github.com/BerriAI/litellm/security/advisories/GHSA-3cv6-jpf6-8222","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84377.json","https://nvd.nist.gov/vuln/detail/CVE-2026-84377","https://github.com/BerriAI/litellm/commit/473f72e63a9777d793fbbf57194d8ec4fb97bc1b","https://github.com/BerriAI/litellm/commit/820f247a6abba55cd87d130bef7bba7be3b29d37","https://github.com/BerriAI/litellm/commit/c898d341c02299cf2506d0d8e84cc67953043593","https://github.com/BerriAI/litellm/pull/36011","https://github.com/BerriAI/litellm/pull/36314","https://github.com/BerriAI/litellm/pull/36494"]},"related_cves":[{"value":"CVE-2026-84377","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:78bc32f6-081a-4d5d-b20c-951397a1ca0c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9gp2-gx2g-8rh4","advisory_id":"78bc32f6-081a-4d5d-b20c-951397a1ca0c","event_types":["advisory"],"published_at":"2026-10-25T22:56:26.685839+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:38+00:00","detail_url":"/events/71591"}]}},{"id":71174,"cve_ids":["CVE-2026-97687"],"payload":{"kind":"advisory","title":"CGA-46g7-vvj7-fv2c","summary":"CGA-46g7-vvj7-fv2c","evidence":"osv:CGA-46g7-vvj7-fv2c","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-46g7-vvj7-fv2c","aliases":["CGA-46g7-vvj7-fv2c"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-46g7-vvj7-fv2c.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:11Z"}]}}],"modified":"2026-10-02T23:00:24.207374721Z","provider":"osv","upstream":["CVE-2026-97687","GHSA-8988-9cw3-xx77"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97687.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093"]},"related_cves":[{"value":"CVE-2026-97687","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1522029b-753a-4fec-a4d1-2c2139e295eb","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97687","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97687","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-46g7-vvj7-fv2c","advisory_id":"1522029b-753a-4fec-a4d1-2c2139e295eb","event_types":["advisory"],"published_at":"2026-10-25T22:54:30.273909+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:41+00:00","detail_url":"/advisories/advisory%3A1522029b-753a-4fec-a4d1-2c2139e295eb","group":{"id":"advisory:1522029b-753a-4fec-a4d1-2c2139e295eb","revision":1,"primary_event_id":71554,"change":"published","superseded_by":[],"changed":{"id":71554,"cve_ids":["CVE-2026-97687"],"payload":{"kind":"advisory","title":"CGA-46g7-vvj7-fv2c","summary":"CGA-46g7-vvj7-fv2c","evidence":"osv:CGA-46g7-vvj7-fv2c","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-46g7-vvj7-fv2c","aliases":["CGA-46g7-vvj7-fv2c"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-46g7-vvj7-fv2c.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:11Z"}]}}],"modified":"2026-10-02T23:00:24.207374721Z","provider":"osv","upstream":["CVE-2026-97687","GHSA-8988-9cw3-xx77"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97687.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093"]},"related_cves":[{"value":"CVE-2026-97687","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1522029b-753a-4fec-a4d1-2c2139e295eb","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97687","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97687","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-46g7-vvj7-fv2c","advisory_id":"1522029b-753a-4fec-a4d1-2c2139e295eb","event_types":["advisory"],"published_at":"2026-10-25T22:54:30.273909+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:41+00:00","detail_url":"/events/71554"},"members":[{"id":71554,"cve_ids":["CVE-2026-97687"],"payload":{"kind":"advisory","title":"CGA-46g7-vvj7-fv2c","summary":"CGA-46g7-vvj7-fv2c","evidence":"osv:CGA-46g7-vvj7-fv2c","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-46g7-vvj7-fv2c","aliases":["CGA-46g7-vvj7-fv2c"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-46g7-vvj7-fv2c.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:29:11Z"}]}}],"modified":"2026-10-02T23:00:24.207374721Z","provider":"osv","upstream":["CVE-2026-97687","GHSA-8988-9cw3-xx77"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97687.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093"]},"related_cves":[{"value":"CVE-2026-97687","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1522029b-753a-4fec-a4d1-2c2139e295eb","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97687","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97687","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-46g7-vvj7-fv2c","advisory_id":"1522029b-753a-4fec-a4d1-2c2139e295eb","event_types":["advisory"],"published_at":"2026-10-25T22:54:30.273909+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:41+00:00","detail_url":"/events/71554"}]}},{"id":71082,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2vmh-5c44-93p2","summary":"CGA-2vmh-5c44-93p2","evidence":"osv:CGA-2vmh-5c44-93p2","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2vmh-5c44-93p2","aliases":["CGA-2vmh-5c44-93p2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2vmh-5c44-93p2.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:15Z"}]}}],"modified":"2026-10-02T23:00:13.556391318Z","provider":"osv","upstream":["GHSA-3hv7-mjh2-fv65"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93","https://github.com/tornadoweb/tornado/commit/8a61dd6005f42733015160f3c23a2bcffe200542","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f4e710d6-7f11-4647-a953-a5aaa15429cf","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2vmh-5c44-93p2","advisory_id":"f4e710d6-7f11-4647-a953-a5aaa15429cf","event_types":["advisory"],"published_at":"2026-10-25T22:49:55.136821+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:39+00:00","detail_url":"/advisories/advisory%3Af4e710d6-7f11-4647-a953-a5aaa15429cf","group":{"id":"advisory:f4e710d6-7f11-4647-a953-a5aaa15429cf","revision":1,"primary_event_id":71456,"change":"published","superseded_by":[],"changed":{"id":71456,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2vmh-5c44-93p2","summary":"CGA-2vmh-5c44-93p2","evidence":"osv:CGA-2vmh-5c44-93p2","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2vmh-5c44-93p2","aliases":["CGA-2vmh-5c44-93p2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2vmh-5c44-93p2.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:15Z"}]}}],"modified":"2026-10-02T23:00:13.556391318Z","provider":"osv","upstream":["GHSA-3hv7-mjh2-fv65"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93","https://github.com/tornadoweb/tornado/commit/8a61dd6005f42733015160f3c23a2bcffe200542","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f4e710d6-7f11-4647-a953-a5aaa15429cf","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2vmh-5c44-93p2","advisory_id":"f4e710d6-7f11-4647-a953-a5aaa15429cf","event_types":["advisory"],"published_at":"2026-10-25T22:49:55.136821+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:39+00:00","detail_url":"/events/71456"},"members":[{"id":71456,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2vmh-5c44-93p2","summary":"CGA-2vmh-5c44-93p2","evidence":"osv:CGA-2vmh-5c44-93p2","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2vmh-5c44-93p2","aliases":["CGA-2vmh-5c44-93p2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2vmh-5c44-93p2.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:15Z"}]}}],"modified":"2026-10-02T23:00:13.556391318Z","provider":"osv","upstream":["GHSA-3hv7-mjh2-fv65"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93","https://github.com/tornadoweb/tornado/commit/8a61dd6005f42733015160f3c23a2bcffe200542","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f4e710d6-7f11-4647-a953-a5aaa15429cf","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2vmh-5c44-93p2","advisory_id":"f4e710d6-7f11-4647-a953-a5aaa15429cf","event_types":["advisory"],"published_at":"2026-10-25T22:49:55.136821+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:39+00:00","detail_url":"/events/71456"}]}},{"id":71025,"cve_ids":["CVE-2026-101918"],"payload":{"kind":"advisory","title":"CGA-3wjx-q2vf-v864","summary":"CGA-3wjx-q2vf-v864","evidence":"osv:CGA-3wjx-q2vf-v864","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3wjx-q2vf-v864","aliases":["CGA-3wjx-q2vf-v864"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3wjx-q2vf-v864.json"},"ecosystem_specific":{"components":[{"component_name":"pyjwt","component_purl":"pkg:pypi/pyjwt@2.14.0","component_type":"python","component_version":"2.14.0","component_location":"/opt/airflow/lib/python3.12/site-packages/pyjwt-2.14.0.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:14Z"}]}}],"modified":"2026-10-02T23:00:07.487812635Z","provider":"osv","upstream":["CVE-2026-101918","GHSA-42vr-xj54-vc7v"],"references":["https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101918.json","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v","https://nvd.nist.gov/vuln/detail/CVE-2026-101918","https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b"]},"related_cves":[{"value":"CVE-2026-101918","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1c169c1d-a671-4e3c-bf6b-e7a66819bfef","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101918","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101918","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3wjx-q2vf-v864","advisory_id":"1c169c1d-a671-4e3c-bf6b-e7a66819bfef","event_types":["advisory"],"published_at":"2026-10-25T22:47:29.702161+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:39+00:00","detail_url":"/advisories/advisory%3A1c169c1d-a671-4e3c-bf6b-e7a66819bfef","group":{"id":"advisory:1c169c1d-a671-4e3c-bf6b-e7a66819bfef","revision":1,"primary_event_id":71399,"change":"published","superseded_by":[],"changed":{"id":71399,"cve_ids":["CVE-2026-101918"],"payload":{"kind":"advisory","title":"CGA-3wjx-q2vf-v864","summary":"CGA-3wjx-q2vf-v864","evidence":"osv:CGA-3wjx-q2vf-v864","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3wjx-q2vf-v864","aliases":["CGA-3wjx-q2vf-v864"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3wjx-q2vf-v864.json"},"ecosystem_specific":{"components":[{"component_name":"pyjwt","component_purl":"pkg:pypi/pyjwt@2.14.0","component_type":"python","component_version":"2.14.0","component_location":"/opt/airflow/lib/python3.12/site-packages/pyjwt-2.14.0.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:14Z"}]}}],"modified":"2026-10-02T23:00:07.487812635Z","provider":"osv","upstream":["CVE-2026-101918","GHSA-42vr-xj54-vc7v"],"references":["https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101918.json","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v","https://nvd.nist.gov/vuln/detail/CVE-2026-101918","https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b"]},"related_cves":[{"value":"CVE-2026-101918","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1c169c1d-a671-4e3c-bf6b-e7a66819bfef","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101918","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101918","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3wjx-q2vf-v864","advisory_id":"1c169c1d-a671-4e3c-bf6b-e7a66819bfef","event_types":["advisory"],"published_at":"2026-10-25T22:47:29.702161+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:39+00:00","detail_url":"/events/71399"},"members":[{"id":71399,"cve_ids":["CVE-2026-101918"],"payload":{"kind":"advisory","title":"CGA-3wjx-q2vf-v864","summary":"CGA-3wjx-q2vf-v864","evidence":"osv:CGA-3wjx-q2vf-v864","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3wjx-q2vf-v864","aliases":["CGA-3wjx-q2vf-v864"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3wjx-q2vf-v864.json"},"ecosystem_specific":{"components":[{"component_name":"pyjwt","component_purl":"pkg:pypi/pyjwt@2.14.0","component_type":"python","component_version":"2.14.0","component_location":"/opt/airflow/lib/python3.12/site-packages/pyjwt-2.14.0.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T16:29:14Z"}]}}],"modified":"2026-10-02T23:00:07.487812635Z","provider":"osv","upstream":["CVE-2026-101918","GHSA-42vr-xj54-vc7v"],"references":["https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101918.json","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v","https://nvd.nist.gov/vuln/detail/CVE-2026-101918","https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b"]},"related_cves":[{"value":"CVE-2026-101918","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1c169c1d-a671-4e3c-bf6b-e7a66819bfef","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101918","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101918","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3wjx-q2vf-v864","advisory_id":"1c169c1d-a671-4e3c-bf6b-e7a66819bfef","event_types":["advisory"],"published_at":"2026-10-25T22:47:29.702161+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:38:39+00:00","detail_url":"/events/71399"}]}},{"id":70834,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-xq89-f5vc-8774","summary":"CGA-xq89-f5vc-8774","evidence":"osv:CGA-xq89-f5vc-8774","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xq89-f5vc-8774","aliases":["CGA-xq89-f5vc-8774"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xq89-f5vc-8774.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:08:02Z"}]}}],"modified":"2026-10-02T18:25:48.972722394Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6e1950f4-494a-4c66-9279-4a02bcdbf27c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xq89-f5vc-8774","advisory_id":"6e1950f4-494a-4c66-9279-4a02bcdbf27c","event_types":["advisory"],"published_at":"2026-10-25T22:41:31.677873+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:24:50+00:00","detail_url":"/advisories/advisory%3A6e1950f4-494a-4c66-9279-4a02bcdbf27c","group":{"id":"advisory:6e1950f4-494a-4c66-9279-4a02bcdbf27c","revision":1,"primary_event_id":71205,"change":"published","superseded_by":[],"changed":{"id":71205,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-xq89-f5vc-8774","summary":"CGA-xq89-f5vc-8774","evidence":"osv:CGA-xq89-f5vc-8774","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xq89-f5vc-8774","aliases":["CGA-xq89-f5vc-8774"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xq89-f5vc-8774.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:08:02Z"}]}}],"modified":"2026-10-02T18:25:48.972722394Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6e1950f4-494a-4c66-9279-4a02bcdbf27c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xq89-f5vc-8774","advisory_id":"6e1950f4-494a-4c66-9279-4a02bcdbf27c","event_types":["advisory"],"published_at":"2026-10-25T22:41:31.677873+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:24:50+00:00","detail_url":"/events/71205"},"members":[{"id":71205,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-xq89-f5vc-8774","summary":"CGA-xq89-f5vc-8774","evidence":"osv:CGA-xq89-f5vc-8774","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xq89-f5vc-8774","aliases":["CGA-xq89-f5vc-8774"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xq89-f5vc-8774.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:08:02Z"}]}}],"modified":"2026-10-02T18:25:48.972722394Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6e1950f4-494a-4c66-9279-4a02bcdbf27c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xq89-f5vc-8774","advisory_id":"6e1950f4-494a-4c66-9279-4a02bcdbf27c","event_types":["advisory"],"published_at":"2026-10-25T22:41:31.677873+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:24:50+00:00","detail_url":"/events/71205"}]}},{"id":70416,"cve_ids":["CVE-2026-49264"],"payload":{"kind":"advisory","title":"CGA-qf52-rgh9-wwpj","summary":"CGA-qf52-rgh9-wwpj","evidence":"osv:CGA-qf52-rgh9-wwpj","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qf52-rgh9-wwpj","aliases":["CGA-qf52-rgh9-wwpj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qf52-rgh9-wwpj.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:27.748092308Z","provider":"osv","upstream":["CVE-2026-49264","GHSA-hj66-6f7g-4r5v"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v","https://github.com/oauthlib/oauthlib/pull/951","https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49264","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c5a22fa4-49e3-452c-ab98-19e02ac5dd45","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49264","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qf52-rgh9-wwpj","advisory_id":"c5a22fa4-49e3-452c-ab98-19e02ac5dd45","event_types":["advisory"],"published_at":"2026-10-25T22:23:55.817566+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:45+00:00","detail_url":"/advisories/advisory%3Ac5a22fa4-49e3-452c-ab98-19e02ac5dd45","group":{"id":"advisory:c5a22fa4-49e3-452c-ab98-19e02ac5dd45","revision":1,"primary_event_id":70786,"change":"published","superseded_by":[],"changed":{"id":70786,"cve_ids":["CVE-2026-49264"],"payload":{"kind":"advisory","title":"CGA-qf52-rgh9-wwpj","summary":"CGA-qf52-rgh9-wwpj","evidence":"osv:CGA-qf52-rgh9-wwpj","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qf52-rgh9-wwpj","aliases":["CGA-qf52-rgh9-wwpj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qf52-rgh9-wwpj.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:27.748092308Z","provider":"osv","upstream":["CVE-2026-49264","GHSA-hj66-6f7g-4r5v"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v","https://github.com/oauthlib/oauthlib/pull/951","https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49264","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c5a22fa4-49e3-452c-ab98-19e02ac5dd45","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49264","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qf52-rgh9-wwpj","advisory_id":"c5a22fa4-49e3-452c-ab98-19e02ac5dd45","event_types":["advisory"],"published_at":"2026-10-25T22:23:55.817566+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:45+00:00","detail_url":"/events/70786"},"members":[{"id":70786,"cve_ids":["CVE-2026-49264"],"payload":{"kind":"advisory","title":"CGA-qf52-rgh9-wwpj","summary":"CGA-qf52-rgh9-wwpj","evidence":"osv:CGA-qf52-rgh9-wwpj","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-qf52-rgh9-wwpj","aliases":["CGA-qf52-rgh9-wwpj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qf52-rgh9-wwpj.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:27.748092308Z","provider":"osv","upstream":["CVE-2026-49264","GHSA-hj66-6f7g-4r5v"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v","https://github.com/oauthlib/oauthlib/pull/951","https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49264","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c5a22fa4-49e3-452c-ab98-19e02ac5dd45","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49264","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-qf52-rgh9-wwpj","advisory_id":"c5a22fa4-49e3-452c-ab98-19e02ac5dd45","event_types":["advisory"],"published_at":"2026-10-25T22:23:55.817566+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:45+00:00","detail_url":"/events/70786"}]}},{"id":70353,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-4928-hr27-622g","summary":"CGA-4928-hr27-622g","evidence":"osv:CGA-4928-hr27-622g","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4928-hr27-622g","aliases":["CGA-4928-hr27-622g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4928-hr27-622g.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:24.601259801Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5690aba1-f68e-4b1d-bb71-e56a0f071389","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4928-hr27-622g","advisory_id":"5690aba1-f68e-4b1d-bb71-e56a0f071389","event_types":["advisory"],"published_at":"2026-10-25T22:22:00.113614+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:43+00:00","detail_url":"/advisories/advisory%3A5690aba1-f68e-4b1d-bb71-e56a0f071389","group":{"id":"advisory:5690aba1-f68e-4b1d-bb71-e56a0f071389","revision":1,"primary_event_id":70723,"change":"published","superseded_by":[],"changed":{"id":70723,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-4928-hr27-622g","summary":"CGA-4928-hr27-622g","evidence":"osv:CGA-4928-hr27-622g","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4928-hr27-622g","aliases":["CGA-4928-hr27-622g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4928-hr27-622g.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:24.601259801Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5690aba1-f68e-4b1d-bb71-e56a0f071389","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4928-hr27-622g","advisory_id":"5690aba1-f68e-4b1d-bb71-e56a0f071389","event_types":["advisory"],"published_at":"2026-10-25T22:22:00.113614+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:43+00:00","detail_url":"/events/70723"},"members":[{"id":70723,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-4928-hr27-622g","summary":"CGA-4928-hr27-622g","evidence":"osv:CGA-4928-hr27-622g","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4928-hr27-622g","aliases":["CGA-4928-hr27-622g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4928-hr27-622g.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:24.601259801Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5690aba1-f68e-4b1d-bb71-e56a0f071389","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4928-hr27-622g","advisory_id":"5690aba1-f68e-4b1d-bb71-e56a0f071389","event_types":["advisory"],"published_at":"2026-10-25T22:22:00.113614+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:43+00:00","detail_url":"/events/70723"}]}},{"id":70264,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-c2hm-rm7q-pj26","summary":"CGA-c2hm-rm7q-pj26","evidence":"osv:CGA-c2hm-rm7q-pj26","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c2hm-rm7q-pj26","aliases":["CGA-c2hm-rm7q-pj26"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2hm-rm7q-pj26.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:20.746674029Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2162a601-2441-4adc-8897-bec92a296a00","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2hm-rm7q-pj26","advisory_id":"2162a601-2441-4adc-8897-bec92a296a00","event_types":["advisory"],"published_at":"2026-10-25T22:19:26.008945+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:45+00:00","detail_url":"/advisories/advisory%3A2162a601-2441-4adc-8897-bec92a296a00","group":{"id":"advisory:2162a601-2441-4adc-8897-bec92a296a00","revision":1,"primary_event_id":70634,"change":"published","superseded_by":[],"changed":{"id":70634,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-c2hm-rm7q-pj26","summary":"CGA-c2hm-rm7q-pj26","evidence":"osv:CGA-c2hm-rm7q-pj26","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c2hm-rm7q-pj26","aliases":["CGA-c2hm-rm7q-pj26"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2hm-rm7q-pj26.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:20.746674029Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2162a601-2441-4adc-8897-bec92a296a00","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2hm-rm7q-pj26","advisory_id":"2162a601-2441-4adc-8897-bec92a296a00","event_types":["advisory"],"published_at":"2026-10-25T22:19:26.008945+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:45+00:00","detail_url":"/events/70634"},"members":[{"id":70634,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-c2hm-rm7q-pj26","summary":"CGA-c2hm-rm7q-pj26","evidence":"osv:CGA-c2hm-rm7q-pj26","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c2hm-rm7q-pj26","aliases":["CGA-c2hm-rm7q-pj26"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2hm-rm7q-pj26.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:20.746674029Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2162a601-2441-4adc-8897-bec92a296a00","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2hm-rm7q-pj26","advisory_id":"2162a601-2441-4adc-8897-bec92a296a00","event_types":["advisory"],"published_at":"2026-10-25T22:19:26.008945+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:45+00:00","detail_url":"/events/70634"}]}},{"id":70123,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-4rg5-72j7-5g3f","summary":"CGA-4rg5-72j7-5g3f","evidence":"osv:CGA-4rg5-72j7-5g3f","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4rg5-72j7-5g3f","aliases":["CGA-4rg5-72j7-5g3f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4rg5-72j7-5g3f.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:13.767761270Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:12e13194-d263-4d35-9f61-55963115c551","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4rg5-72j7-5g3f","advisory_id":"12e13194-d263-4d35-9f61-55963115c551","event_types":["advisory"],"published_at":"2026-10-25T22:14:50.535339+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:43+00:00","detail_url":"/advisories/advisory%3A12e13194-d263-4d35-9f61-55963115c551","group":{"id":"advisory:12e13194-d263-4d35-9f61-55963115c551","revision":1,"primary_event_id":70493,"change":"published","superseded_by":[],"changed":{"id":70493,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-4rg5-72j7-5g3f","summary":"CGA-4rg5-72j7-5g3f","evidence":"osv:CGA-4rg5-72j7-5g3f","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4rg5-72j7-5g3f","aliases":["CGA-4rg5-72j7-5g3f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4rg5-72j7-5g3f.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:13.767761270Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:12e13194-d263-4d35-9f61-55963115c551","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4rg5-72j7-5g3f","advisory_id":"12e13194-d263-4d35-9f61-55963115c551","event_types":["advisory"],"published_at":"2026-10-25T22:14:50.535339+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:43+00:00","detail_url":"/events/70493"},"members":[{"id":70493,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-4rg5-72j7-5g3f","summary":"CGA-4rg5-72j7-5g3f","evidence":"osv:CGA-4rg5-72j7-5g3f","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4rg5-72j7-5g3f","aliases":["CGA-4rg5-72j7-5g3f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4rg5-72j7-5g3f.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.11","component_type":"npm","component_version":"1.1.11","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:13.767761270Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:12e13194-d263-4d35-9f61-55963115c551","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4rg5-72j7-5g3f","advisory_id":"12e13194-d263-4d35-9f61-55963115c551","event_types":["advisory"],"published_at":"2026-10-25T22:14:50.535339+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:43+00:00","detail_url":"/events/70493"}]}},{"id":69723,"cve_ids":["CVE-2026-101898"],"payload":{"kind":"advisory","title":"CGA-wr89-j265-rm9p","summary":"CGA-wr89-j265-rm9p","evidence":"osv:CGA-wr89-j265-rm9p","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wr89-j265-rm9p","aliases":["CGA-wr89-j265-rm9p"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wr89-j265-rm9p.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:42Z"}]}}],"modified":"2026-10-02T17:16:49.969646466Z","provider":"osv","upstream":["CVE-2026-101898","GHSA-3pq3-5fj3-cg6v"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101898.json","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101898","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e788f713-4fe0-4356-85bb-b825284deb18","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101898","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101898","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101898","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wr89-j265-rm9p","advisory_id":"e788f713-4fe0-4356-85bb-b825284deb18","event_types":["advisory"],"published_at":"2026-10-25T22:06:18.5595+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/advisories/advisory%3Ae788f713-4fe0-4356-85bb-b825284deb18","group":{"id":"advisory:e788f713-4fe0-4356-85bb-b825284deb18","revision":1,"primary_event_id":70093,"change":"published","superseded_by":[],"changed":{"id":70093,"cve_ids":["CVE-2026-101898"],"payload":{"kind":"advisory","title":"CGA-wr89-j265-rm9p","summary":"CGA-wr89-j265-rm9p","evidence":"osv:CGA-wr89-j265-rm9p","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wr89-j265-rm9p","aliases":["CGA-wr89-j265-rm9p"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wr89-j265-rm9p.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:42Z"}]}}],"modified":"2026-10-02T17:16:49.969646466Z","provider":"osv","upstream":["CVE-2026-101898","GHSA-3pq3-5fj3-cg6v"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101898.json","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101898","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e788f713-4fe0-4356-85bb-b825284deb18","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101898","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101898","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101898","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wr89-j265-rm9p","advisory_id":"e788f713-4fe0-4356-85bb-b825284deb18","event_types":["advisory"],"published_at":"2026-10-25T22:06:18.5595+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/70093"},"members":[{"id":70093,"cve_ids":["CVE-2026-101898"],"payload":{"kind":"advisory","title":"CGA-wr89-j265-rm9p","summary":"CGA-wr89-j265-rm9p","evidence":"osv:CGA-wr89-j265-rm9p","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wr89-j265-rm9p","aliases":["CGA-wr89-j265-rm9p"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wr89-j265-rm9p.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:42Z"}]}}],"modified":"2026-10-02T17:16:49.969646466Z","provider":"osv","upstream":["CVE-2026-101898","GHSA-3pq3-5fj3-cg6v"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101898.json","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101898","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e788f713-4fe0-4356-85bb-b825284deb18","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101898","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101898","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101898","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wr89-j265-rm9p","advisory_id":"e788f713-4fe0-4356-85bb-b825284deb18","event_types":["advisory"],"published_at":"2026-10-25T22:06:18.5595+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/70093"}]}},{"id":69675,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-rgm9-qch9-6wqh","summary":"CGA-rgm9-qch9-6wqh","evidence":"osv:CGA-rgm9-qch9-6wqh","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rgm9-qch9-6wqh","aliases":["CGA-rgm9-qch9-6wqh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rgm9-qch9-6wqh.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:44Z"}]}}],"modified":"2026-10-02T17:16:47.564632278Z","provider":"osv","upstream":["GHSA-chx6-46f5-w4vp"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/15f056080d8e456f92cca8ad0c33e5a5480414ac","https://github.com/tornadoweb/tornado/commit/6564e0a0922c16f239d3a18adccd04736e380c89","https://github.com/tornadoweb/tornado/commit/aa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4","https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:672b3539-9195-4885-8f41-c03f9fce95c9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rgm9-qch9-6wqh","advisory_id":"672b3539-9195-4885-8f41-c03f9fce95c9","event_types":["advisory"],"published_at":"2026-10-25T22:05:09.986642+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/advisories/advisory%3A672b3539-9195-4885-8f41-c03f9fce95c9","group":{"id":"advisory:672b3539-9195-4885-8f41-c03f9fce95c9","revision":1,"primary_event_id":70045,"change":"published","superseded_by":[],"changed":{"id":70045,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-rgm9-qch9-6wqh","summary":"CGA-rgm9-qch9-6wqh","evidence":"osv:CGA-rgm9-qch9-6wqh","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rgm9-qch9-6wqh","aliases":["CGA-rgm9-qch9-6wqh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rgm9-qch9-6wqh.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:44Z"}]}}],"modified":"2026-10-02T17:16:47.564632278Z","provider":"osv","upstream":["GHSA-chx6-46f5-w4vp"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/15f056080d8e456f92cca8ad0c33e5a5480414ac","https://github.com/tornadoweb/tornado/commit/6564e0a0922c16f239d3a18adccd04736e380c89","https://github.com/tornadoweb/tornado/commit/aa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4","https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:672b3539-9195-4885-8f41-c03f9fce95c9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rgm9-qch9-6wqh","advisory_id":"672b3539-9195-4885-8f41-c03f9fce95c9","event_types":["advisory"],"published_at":"2026-10-25T22:05:09.986642+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/70045"},"members":[{"id":70045,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-rgm9-qch9-6wqh","summary":"CGA-rgm9-qch9-6wqh","evidence":"osv:CGA-rgm9-qch9-6wqh","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rgm9-qch9-6wqh","aliases":["CGA-rgm9-qch9-6wqh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rgm9-qch9-6wqh.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:44Z"}]}}],"modified":"2026-10-02T17:16:47.564632278Z","provider":"osv","upstream":["GHSA-chx6-46f5-w4vp"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/15f056080d8e456f92cca8ad0c33e5a5480414ac","https://github.com/tornadoweb/tornado/commit/6564e0a0922c16f239d3a18adccd04736e380c89","https://github.com/tornadoweb/tornado/commit/aa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4","https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:672b3539-9195-4885-8f41-c03f9fce95c9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rgm9-qch9-6wqh","advisory_id":"672b3539-9195-4885-8f41-c03f9fce95c9","event_types":["advisory"],"published_at":"2026-10-25T22:05:09.986642+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/70045"}]}},{"id":69567,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-w8cq-r346-jvmr","summary":"CGA-w8cq-r346-jvmr","evidence":"osv:CGA-w8cq-r346-jvmr","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-w8cq-r346-jvmr","aliases":["CGA-w8cq-r346-jvmr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w8cq-r346-jvmr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/opt/airflow/lib/python3.12/site-packages/ray/jars/ray_dist.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:42.697823967Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:44b1dd50-1d01-4e16-a940-1b5624c1897d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w8cq-r346-jvmr","advisory_id":"44b1dd50-1d01-4e16-a940-1b5624c1897d","event_types":["advisory"],"published_at":"2026-10-25T22:02:46.778307+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/advisories/advisory%3A44b1dd50-1d01-4e16-a940-1b5624c1897d","group":{"id":"advisory:44b1dd50-1d01-4e16-a940-1b5624c1897d","revision":1,"primary_event_id":69937,"change":"published","superseded_by":[],"changed":{"id":69937,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-w8cq-r346-jvmr","summary":"CGA-w8cq-r346-jvmr","evidence":"osv:CGA-w8cq-r346-jvmr","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-w8cq-r346-jvmr","aliases":["CGA-w8cq-r346-jvmr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w8cq-r346-jvmr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/opt/airflow/lib/python3.12/site-packages/ray/jars/ray_dist.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:42.697823967Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:44b1dd50-1d01-4e16-a940-1b5624c1897d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w8cq-r346-jvmr","advisory_id":"44b1dd50-1d01-4e16-a940-1b5624c1897d","event_types":["advisory"],"published_at":"2026-10-25T22:02:46.778307+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69937"},"members":[{"id":69937,"cve_ids":["CVE-2026-91776"],"payload":{"kind":"advisory","title":"CGA-w8cq-r346-jvmr","summary":"CGA-w8cq-r346-jvmr","evidence":"osv:CGA-w8cq-r346-jvmr","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-w8cq-r346-jvmr","aliases":["CGA-w8cq-r346-jvmr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w8cq-r346-jvmr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/opt/airflow/lib/python3.12/site-packages/ray/jars/ray_dist.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:42.697823967Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:44b1dd50-1d01-4e16-a940-1b5624c1897d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w8cq-r346-jvmr","advisory_id":"44b1dd50-1d01-4e16-a940-1b5624c1897d","event_types":["advisory"],"published_at":"2026-10-25T22:02:46.778307+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69937"}]}},{"id":69537,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-q29m-fv4m-8qrh","summary":"CGA-q29m-fv4m-8qrh","evidence":"osv:CGA-q29m-fv4m-8qrh","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-q29m-fv4m-8qrh","aliases":["CGA-q29m-fv4m-8qrh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q29m-fv4m-8qrh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/opt/airflow/lib/python3.12/site-packages/ray/jars/ray_dist.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:41.434314452Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:61498b22-c69b-4036-8c13-7774350f1849","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q29m-fv4m-8qrh","advisory_id":"61498b22-c69b-4036-8c13-7774350f1849","event_types":["advisory"],"published_at":"2026-10-25T22:01:08.830783+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/advisories/advisory%3A61498b22-c69b-4036-8c13-7774350f1849","group":{"id":"advisory:61498b22-c69b-4036-8c13-7774350f1849","revision":1,"primary_event_id":69907,"change":"published","superseded_by":[],"changed":{"id":69907,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-q29m-fv4m-8qrh","summary":"CGA-q29m-fv4m-8qrh","evidence":"osv:CGA-q29m-fv4m-8qrh","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-q29m-fv4m-8qrh","aliases":["CGA-q29m-fv4m-8qrh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q29m-fv4m-8qrh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/opt/airflow/lib/python3.12/site-packages/ray/jars/ray_dist.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:41.434314452Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:61498b22-c69b-4036-8c13-7774350f1849","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q29m-fv4m-8qrh","advisory_id":"61498b22-c69b-4036-8c13-7774350f1849","event_types":["advisory"],"published_at":"2026-10-25T22:01:08.830783+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69907"},"members":[{"id":69907,"cve_ids":["CVE-2026-91777"],"payload":{"kind":"advisory","title":"CGA-q29m-fv4m-8qrh","summary":"CGA-q29m-fv4m-8qrh","evidence":"osv:CGA-q29m-fv4m-8qrh","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-q29m-fv4m-8qrh","aliases":["CGA-q29m-fv4m-8qrh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q29m-fv4m-8qrh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.16.1","component_type":"java-archive","component_version":"2.16.1","component_location":"/opt/airflow/lib/python3.12/site-packages/ray/jars/ray_dist.jar","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:41.434314452Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:61498b22-c69b-4036-8c13-7774350f1849","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q29m-fv4m-8qrh","advisory_id":"61498b22-c69b-4036-8c13-7774350f1849","event_types":["advisory"],"published_at":"2026-10-25T22:01:08.830783+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69907"}]}},{"id":69483,"cve_ids":["CVE-2026-101901"],"payload":{"kind":"advisory","title":"CGA-m6qv-g6pp-mw7j","summary":"CGA-m6qv-g6pp-mw7j","evidence":"osv:CGA-m6qv-g6pp-mw7j","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m6qv-g6pp-mw7j","aliases":["CGA-m6qv-g6pp-mw7j"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6qv-g6pp-mw7j.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:42Z"}]}}],"modified":"2026-10-02T17:16:39.318023807Z","provider":"osv","upstream":["CVE-2026-101901","GHSA-542g-h47m-68v8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101901.json","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101901","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4c88570a-d9c4-4a45-9c7f-75d8f9d99673","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6qv-g6pp-mw7j","advisory_id":"4c88570a-d9c4-4a45-9c7f-75d8f9d99673","event_types":["advisory"],"published_at":"2026-10-25T21:59:52.053804+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/advisories/advisory%3A4c88570a-d9c4-4a45-9c7f-75d8f9d99673","group":{"id":"advisory:4c88570a-d9c4-4a45-9c7f-75d8f9d99673","revision":1,"primary_event_id":69853,"change":"published","superseded_by":[],"changed":{"id":69853,"cve_ids":["CVE-2026-101901"],"payload":{"kind":"advisory","title":"CGA-m6qv-g6pp-mw7j","summary":"CGA-m6qv-g6pp-mw7j","evidence":"osv:CGA-m6qv-g6pp-mw7j","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m6qv-g6pp-mw7j","aliases":["CGA-m6qv-g6pp-mw7j"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6qv-g6pp-mw7j.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:42Z"}]}}],"modified":"2026-10-02T17:16:39.318023807Z","provider":"osv","upstream":["CVE-2026-101901","GHSA-542g-h47m-68v8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101901.json","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101901","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4c88570a-d9c4-4a45-9c7f-75d8f9d99673","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6qv-g6pp-mw7j","advisory_id":"4c88570a-d9c4-4a45-9c7f-75d8f9d99673","event_types":["advisory"],"published_at":"2026-10-25T21:59:52.053804+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69853"},"members":[{"id":69853,"cve_ids":["CVE-2026-101901"],"payload":{"kind":"advisory","title":"CGA-m6qv-g6pp-mw7j","summary":"CGA-m6qv-g6pp-mw7j","evidence":"osv:CGA-m6qv-g6pp-mw7j","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m6qv-g6pp-mw7j","aliases":["CGA-m6qv-g6pp-mw7j"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6qv-g6pp-mw7j.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:42Z"}]}}],"modified":"2026-10-02T17:16:39.318023807Z","provider":"osv","upstream":["CVE-2026-101901","GHSA-542g-h47m-68v8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101901.json","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101901","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4c88570a-d9c4-4a45-9c7f-75d8f9d99673","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6qv-g6pp-mw7j","advisory_id":"4c88570a-d9c4-4a45-9c7f-75d8f9d99673","event_types":["advisory"],"published_at":"2026-10-25T21:59:52.053804+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69853"}]}},{"id":69434,"cve_ids":["CVE-2026-101908"],"payload":{"kind":"advisory","title":"CGA-jgvc-chrm-489h","summary":"CGA-jgvc-chrm-489h","evidence":"osv:CGA-jgvc-chrm-489h","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jgvc-chrm-489h","aliases":["CGA-jgvc-chrm-489h"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jgvc-chrm-489h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:42Z"}]}}],"modified":"2026-10-02T17:16:36.747463035Z","provider":"osv","upstream":["CVE-2026-101908","GHSA-vh66-26gq-q6x8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101908.json","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101908","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:889e7e42-84bc-4344-b5cd-70bd425521c6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101908","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101908","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jgvc-chrm-489h","advisory_id":"889e7e42-84bc-4344-b5cd-70bd425521c6","event_types":["advisory"],"published_at":"2026-10-25T21:58:49.603441+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/advisories/advisory%3A889e7e42-84bc-4344-b5cd-70bd425521c6","group":{"id":"advisory:889e7e42-84bc-4344-b5cd-70bd425521c6","revision":1,"primary_event_id":69804,"change":"published","superseded_by":[],"changed":{"id":69804,"cve_ids":["CVE-2026-101908"],"payload":{"kind":"advisory","title":"CGA-jgvc-chrm-489h","summary":"CGA-jgvc-chrm-489h","evidence":"osv:CGA-jgvc-chrm-489h","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jgvc-chrm-489h","aliases":["CGA-jgvc-chrm-489h"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jgvc-chrm-489h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:42Z"}]}}],"modified":"2026-10-02T17:16:36.747463035Z","provider":"osv","upstream":["CVE-2026-101908","GHSA-vh66-26gq-q6x8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101908.json","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101908","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:889e7e42-84bc-4344-b5cd-70bd425521c6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101908","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101908","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jgvc-chrm-489h","advisory_id":"889e7e42-84bc-4344-b5cd-70bd425521c6","event_types":["advisory"],"published_at":"2026-10-25T21:58:49.603441+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69804"},"members":[{"id":69804,"cve_ids":["CVE-2026-101908"],"payload":{"kind":"advisory","title":"CGA-jgvc-chrm-489h","summary":"CGA-jgvc-chrm-489h","evidence":"osv:CGA-jgvc-chrm-489h","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jgvc-chrm-489h","aliases":["CGA-jgvc-chrm-489h"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jgvc-chrm-489h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:42Z"}]}}],"modified":"2026-10-02T17:16:36.747463035Z","provider":"osv","upstream":["CVE-2026-101908","GHSA-vh66-26gq-q6x8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101908.json","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101908","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:889e7e42-84bc-4344-b5cd-70bd425521c6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101908","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101908","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jgvc-chrm-489h","advisory_id":"889e7e42-84bc-4344-b5cd-70bd425521c6","event_types":["advisory"],"published_at":"2026-10-25T21:58:49.603441+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69804"}]}},{"id":69400,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-vv4g-rq2v-7vcg","summary":"CGA-vv4g-rq2v-7vcg","evidence":"osv:CGA-vv4g-rq2v-7vcg","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vv4g-rq2v-7vcg","aliases":["CGA-vv4g-rq2v-7vcg"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vv4g-rq2v-7vcg.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:35.354698439Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2954343b-2b9a-490f-b052-374546af0d2e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vv4g-rq2v-7vcg","advisory_id":"2954343b-2b9a-490f-b052-374546af0d2e","event_types":["advisory"],"published_at":"2026-10-25T21:58:03.785511+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/advisories/advisory%3A2954343b-2b9a-490f-b052-374546af0d2e","group":{"id":"advisory:2954343b-2b9a-490f-b052-374546af0d2e","revision":1,"primary_event_id":69770,"change":"published","superseded_by":[],"changed":{"id":69770,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-vv4g-rq2v-7vcg","summary":"CGA-vv4g-rq2v-7vcg","evidence":"osv:CGA-vv4g-rq2v-7vcg","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vv4g-rq2v-7vcg","aliases":["CGA-vv4g-rq2v-7vcg"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vv4g-rq2v-7vcg.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:35.354698439Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2954343b-2b9a-490f-b052-374546af0d2e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vv4g-rq2v-7vcg","advisory_id":"2954343b-2b9a-490f-b052-374546af0d2e","event_types":["advisory"],"published_at":"2026-10-25T21:58:03.785511+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69770"},"members":[{"id":69770,"cve_ids":["CVE-2026-101902"],"payload":{"kind":"advisory","title":"CGA-vv4g-rq2v-7vcg","summary":"CGA-vv4g-rq2v-7vcg","evidence":"osv:CGA-vv4g-rq2v-7vcg","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vv4g-rq2v-7vcg","aliases":["CGA-vv4g-rq2v-7vcg"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vv4g-rq2v-7vcg.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.13.6","component_type":"npm","component_version":"1.13.6","component_location":"/opt/airflow/lib/python3.12/site-packages/airflow/www/yarn.lock","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:35.354698439Z","provider":"osv","upstream":["CVE-2026-101902","GHSA-9fr6-4gfg-395g"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101902","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2954343b-2b9a-490f-b052-374546af0d2e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101902","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vv4g-rq2v-7vcg","advisory_id":"2954343b-2b9a-490f-b052-374546af0d2e","event_types":["advisory"],"published_at":"2026-10-25T21:58:03.785511+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69770"}]}},{"id":69356,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-h5rc-mcww-q3j8","summary":"CGA-h5rc-mcww-q3j8","evidence":"osv:CGA-h5rc-mcww-q3j8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-h5rc-mcww-q3j8","aliases":["CGA-h5rc-mcww-q3j8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h5rc-mcww-q3j8.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:33.026377654Z","provider":"osv","upstream":["GHSA-3hv7-mjh2-fv65"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93","https://github.com/tornadoweb/tornado/commit/8a61dd6005f42733015160f3c23a2bcffe200542","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0ca303fe-fec4-4c9e-8673-ecffc2fde998","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h5rc-mcww-q3j8","advisory_id":"0ca303fe-fec4-4c9e-8673-ecffc2fde998","event_types":["advisory"],"published_at":"2026-10-25T21:57:10.195003+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/advisories/advisory%3A0ca303fe-fec4-4c9e-8673-ecffc2fde998","group":{"id":"advisory:0ca303fe-fec4-4c9e-8673-ecffc2fde998","revision":1,"primary_event_id":69726,"change":"published","superseded_by":[],"changed":{"id":69726,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-h5rc-mcww-q3j8","summary":"CGA-h5rc-mcww-q3j8","evidence":"osv:CGA-h5rc-mcww-q3j8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-h5rc-mcww-q3j8","aliases":["CGA-h5rc-mcww-q3j8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h5rc-mcww-q3j8.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:33.026377654Z","provider":"osv","upstream":["GHSA-3hv7-mjh2-fv65"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93","https://github.com/tornadoweb/tornado/commit/8a61dd6005f42733015160f3c23a2bcffe200542","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0ca303fe-fec4-4c9e-8673-ecffc2fde998","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h5rc-mcww-q3j8","advisory_id":"0ca303fe-fec4-4c9e-8673-ecffc2fde998","event_types":["advisory"],"published_at":"2026-10-25T21:57:10.195003+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69726"},"members":[{"id":69726,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-h5rc-mcww-q3j8","summary":"CGA-h5rc-mcww-q3j8","evidence":"osv:CGA-h5rc-mcww-q3j8","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-h5rc-mcww-q3j8","aliases":["CGA-h5rc-mcww-q3j8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h5rc-mcww-q3j8.json"},"ecosystem_specific":{"components":[{"component_name":"tornado","component_purl":"pkg:pypi/tornado@6.5.5","component_type":"python","component_version":"6.5.5","component_location":"/opt/airflow/lib/python3.12/site-packages/tornado-6.5.5.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T12:18:43Z"}]}}],"modified":"2026-10-02T17:16:33.026377654Z","provider":"osv","upstream":["GHSA-3hv7-mjh2-fv65"],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65","https://github.com/tornadoweb/tornado/pull/3719","https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93","https://github.com/tornadoweb/tornado/commit/8a61dd6005f42733015160f3c23a2bcffe200542","https://github.com/tornadoweb/tornado","https://github.com/tornadoweb/tornado/releases/tag/v6.5.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:0ca303fe-fec4-4c9e-8673-ecffc2fde998","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h5rc-mcww-q3j8","advisory_id":"0ca303fe-fec4-4c9e-8673-ecffc2fde998","event_types":["advisory"],"published_at":"2026-10-25T21:57:10.195003+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:25+00:00","detail_url":"/events/69726"}]}},{"id":69314,"cve_ids":["CVE-2026-97689"],"payload":{"kind":"advisory","title":"CGA-f62f-hmxq-cjqm","summary":"CGA-f62f-hmxq-cjqm","evidence":"osv:CGA-f62f-hmxq-cjqm","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f62f-hmxq-cjqm","aliases":["CGA-f62f-hmxq-cjqm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f62f-hmxq-cjqm.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T14:25:53Z"}]}}],"modified":"2026-10-02T17:16:31.293549764Z","provider":"osv","upstream":["CVE-2026-97689","GHSA-vxq7-64xx-v4gw"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97689.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"]},"related_cves":[{"value":"CVE-2026-97689","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:67a91b9d-ce18-4074-8f68-4cb7377d8d67","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97689","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.9,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97689","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f62f-hmxq-cjqm","advisory_id":"67a91b9d-ce18-4074-8f68-4cb7377d8d67","event_types":["advisory"],"published_at":"2026-10-25T21:56:20.570205+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:26+00:00","detail_url":"/advisories/advisory%3A67a91b9d-ce18-4074-8f68-4cb7377d8d67","group":{"id":"advisory:67a91b9d-ce18-4074-8f68-4cb7377d8d67","revision":1,"primary_event_id":69684,"change":"published","superseded_by":[],"changed":{"id":69684,"cve_ids":["CVE-2026-97689"],"payload":{"kind":"advisory","title":"CGA-f62f-hmxq-cjqm","summary":"CGA-f62f-hmxq-cjqm","evidence":"osv:CGA-f62f-hmxq-cjqm","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f62f-hmxq-cjqm","aliases":["CGA-f62f-hmxq-cjqm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f62f-hmxq-cjqm.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T14:25:53Z"}]}}],"modified":"2026-10-02T17:16:31.293549764Z","provider":"osv","upstream":["CVE-2026-97689","GHSA-vxq7-64xx-v4gw"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97689.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"]},"related_cves":[{"value":"CVE-2026-97689","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:67a91b9d-ce18-4074-8f68-4cb7377d8d67","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97689","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.9,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97689","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f62f-hmxq-cjqm","advisory_id":"67a91b9d-ce18-4074-8f68-4cb7377d8d67","event_types":["advisory"],"published_at":"2026-10-25T21:56:20.570205+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:26+00:00","detail_url":"/events/69684"},"members":[{"id":69684,"cve_ids":["CVE-2026-97689"],"payload":{"kind":"advisory","title":"CGA-f62f-hmxq-cjqm","summary":"CGA-f62f-hmxq-cjqm","evidence":"osv:CGA-f62f-hmxq-cjqm","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.11.2-r26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f62f-hmxq-cjqm","aliases":["CGA-f62f-hmxq-cjqm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-r26"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f62f-hmxq-cjqm.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.6.3","component_type":"python","component_version":"2.6.3","component_location":"/opt/airflow/lib/python3.12/site-packages/urllib3-2.6.3.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T14:25:53Z"}]}}],"modified":"2026-10-02T17:16:31.293549764Z","provider":"osv","upstream":["CVE-2026-97689","GHSA-vxq7-64xx-v4gw"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97689.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"]},"related_cves":[{"value":"CVE-2026-97689","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:67a91b9d-ce18-4074-8f68-4cb7377d8d67","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97689","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.9,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97689","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f62f-hmxq-cjqm","advisory_id":"67a91b9d-ce18-4074-8f68-4cb7377d8d67","event_types":["advisory"],"published_at":"2026-10-25T21:56:20.570205+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:32:26+00:00","detail_url":"/events/69684"}]}}],"next_after":72030,"next_before":69314}