{"schema_version":"2","view":"grouped","data":[{"id":76679,"cve_ids":["CVE-2026-85393"],"payload":{"kind":"advisory","title":"CGA-3x27-2m5h-wf4g","summary":"CGA-3x27-2m5h-wf4g","evidence":"osv:CGA-3x27-2m5h-wf4g","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3x27-2m5h-wf4g","aliases":["CGA-3x27-2m5h-wf4g"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3x27-2m5h-wf4g.json"},"ecosystem_specific":{"components":[{"component_name":"node-forge","component_purl":"pkg:npm/node-forge@1.4.0","component_type":"npm","component_version":"1.4.0","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-05T13:48:18Z"}]}}],"modified":"2026-10-05T18:15:28.961681527Z","provider":"osv","upstream":["CVE-2026-85393","GHSA-86w9-cpqp-85rv"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85393.json","https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://nvd.nist.gov/vuln/detail/CVE-2026-85393","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding","https://github.com/digitalbazaar/forge/issues/1149","https://github.com/digitalbazaar/forge","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js"]},"related_cves":[{"value":"CVE-2026-85393","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c8df2894-b2c6-467b-ad9c-929fc1617e2e","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85393","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"node-forge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-86w9-cpqp-85rv","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-85393","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"products":[{"name":{"value":"node-forge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.4.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-ppp5-5v6c-4jwp","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3x27-2m5h-wf4g","advisory_id":"c8df2894-b2c6-467b-ad9c-929fc1617e2e","event_types":["advisory"],"published_at":"2026-10-27T01:17:28.846605+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T10:04:08+00:00","detail_url":"/advisories/advisory%3Ac8df2894-b2c6-467b-ad9c-929fc1617e2e","group":{"id":"advisory:c8df2894-b2c6-467b-ad9c-929fc1617e2e","revision":1,"primary_event_id":84843,"change":"published","superseded_by":[],"changed":{"id":84843,"cve_ids":["CVE-2026-85393"],"payload":{"kind":"advisory","title":"CGA-3x27-2m5h-wf4g","summary":"CGA-3x27-2m5h-wf4g","evidence":"osv:CGA-3x27-2m5h-wf4g","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3x27-2m5h-wf4g","aliases":["CGA-3x27-2m5h-wf4g"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3x27-2m5h-wf4g.json"},"ecosystem_specific":{"components":[{"component_name":"node-forge","component_purl":"pkg:npm/node-forge@1.4.0","component_type":"npm","component_version":"1.4.0","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-05T13:48:18Z"}]}}],"modified":"2026-10-05T18:15:28.961681527Z","provider":"osv","upstream":["CVE-2026-85393","GHSA-86w9-cpqp-85rv"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85393.json","https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://nvd.nist.gov/vuln/detail/CVE-2026-85393","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding","https://github.com/digitalbazaar/forge/issues/1149","https://github.com/digitalbazaar/forge","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js"]},"related_cves":[{"value":"CVE-2026-85393","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c8df2894-b2c6-467b-ad9c-929fc1617e2e","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85393","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"node-forge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-86w9-cpqp-85rv","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-85393","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"products":[{"name":{"value":"node-forge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.4.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-ppp5-5v6c-4jwp","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3x27-2m5h-wf4g","advisory_id":"c8df2894-b2c6-467b-ad9c-929fc1617e2e","event_types":["advisory"],"published_at":"2026-10-27T01:17:28.846605+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T10:04:08+00:00","detail_url":"/events/84843"},"members":[{"id":84843,"cve_ids":["CVE-2026-85393"],"payload":{"kind":"advisory","title":"CGA-3x27-2m5h-wf4g","summary":"CGA-3x27-2m5h-wf4g","evidence":"osv:CGA-3x27-2m5h-wf4g","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3x27-2m5h-wf4g","aliases":["CGA-3x27-2m5h-wf4g"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3x27-2m5h-wf4g.json"},"ecosystem_specific":{"components":[{"component_name":"node-forge","component_purl":"pkg:npm/node-forge@1.4.0","component_type":"npm","component_version":"1.4.0","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-05T13:48:18Z"}]}}],"modified":"2026-10-05T18:15:28.961681527Z","provider":"osv","upstream":["CVE-2026-85393","GHSA-86w9-cpqp-85rv"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85393.json","https://github.com/advisories/GHSA-ppp5-5v6c-4jwp","https://nvd.nist.gov/vuln/detail/CVE-2026-85393","https://www.vulncheck.com/advisories/node-forge-through-1.4.0-rsa-pkcs-1-1.5-signature-forgery-via-nested-digestalgorithm-padding","https://github.com/digitalbazaar/forge/issues/1149","https://github.com/digitalbazaar/forge","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/asn1.js","https://github.com/digitalbazaar/forge/blob/v1.4.0/lib/rsa.js"]},"related_cves":[{"value":"CVE-2026-85393","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c8df2894-b2c6-467b-ad9c-929fc1617e2e","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85393","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"node-forge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-86w9-cpqp-85rv","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-85393","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"products":[{"name":{"value":"node-forge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.4.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-ppp5-5v6c-4jwp","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3x27-2m5h-wf4g","advisory_id":"c8df2894-b2c6-467b-ad9c-929fc1617e2e","event_types":["advisory"],"published_at":"2026-10-27T01:17:28.846605+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T10:04:08+00:00","detail_url":"/events/84843"}]}},{"id":74593,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-mq6x-4ggm-v9hj","summary":"CGA-mq6x-4ggm-v9hj","evidence":"osv:CGA-mq6x-4ggm-v9hj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mq6x-4ggm-v9hj","aliases":["CGA-mq6x-4ggm-v9hj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mq6x-4ggm-v9hj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:09Z"}]}}],"modified":"2026-10-03T17:25:12.692503739Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4e5e0231-d76f-4083-944a-28f8350fef88","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mq6x-4ggm-v9hj","advisory_id":"4e5e0231-d76f-4083-944a-28f8350fef88","event_types":["advisory"],"published_at":"2026-10-26T11:38:58.275817+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:31+00:00","detail_url":"/advisories/advisory%3A4e5e0231-d76f-4083-944a-28f8350fef88","group":{"id":"advisory:4e5e0231-d76f-4083-944a-28f8350fef88","revision":1,"primary_event_id":80041,"change":"published","superseded_by":[],"changed":{"id":80041,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-mq6x-4ggm-v9hj","summary":"CGA-mq6x-4ggm-v9hj","evidence":"osv:CGA-mq6x-4ggm-v9hj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mq6x-4ggm-v9hj","aliases":["CGA-mq6x-4ggm-v9hj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mq6x-4ggm-v9hj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:09Z"}]}}],"modified":"2026-10-03T17:25:12.692503739Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4e5e0231-d76f-4083-944a-28f8350fef88","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mq6x-4ggm-v9hj","advisory_id":"4e5e0231-d76f-4083-944a-28f8350fef88","event_types":["advisory"],"published_at":"2026-10-26T11:38:58.275817+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:31+00:00","detail_url":"/events/80041"},"members":[{"id":80041,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-mq6x-4ggm-v9hj","summary":"CGA-mq6x-4ggm-v9hj","evidence":"osv:CGA-mq6x-4ggm-v9hj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mq6x-4ggm-v9hj","aliases":["CGA-mq6x-4ggm-v9hj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mq6x-4ggm-v9hj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:09Z"}]}}],"modified":"2026-10-03T17:25:12.692503739Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4e5e0231-d76f-4083-944a-28f8350fef88","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mq6x-4ggm-v9hj","advisory_id":"4e5e0231-d76f-4083-944a-28f8350fef88","event_types":["advisory"],"published_at":"2026-10-26T11:38:58.275817+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:31+00:00","detail_url":"/events/80041"}]}},{"id":74575,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5m59-6fm8-hgvv","summary":"CGA-5m59-6fm8-hgvv","evidence":"osv:CGA-5m59-6fm8-hgvv","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5m59-6fm8-hgvv","aliases":["CGA-5m59-6fm8-hgvv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5m59-6fm8-hgvv.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:11Z"}]}}],"modified":"2026-10-03T17:25:08.472408650Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:99af7c98-67f0-4568-9944-b12b8dabc2b9","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5m59-6fm8-hgvv","advisory_id":"99af7c98-67f0-4568-9944-b12b8dabc2b9","event_types":["advisory"],"published_at":"2026-10-26T11:31:05.872911+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:31+00:00","detail_url":"/advisories/advisory%3A99af7c98-67f0-4568-9944-b12b8dabc2b9","group":{"id":"advisory:99af7c98-67f0-4568-9944-b12b8dabc2b9","revision":1,"primary_event_id":79974,"change":"published","superseded_by":[],"changed":{"id":79974,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5m59-6fm8-hgvv","summary":"CGA-5m59-6fm8-hgvv","evidence":"osv:CGA-5m59-6fm8-hgvv","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5m59-6fm8-hgvv","aliases":["CGA-5m59-6fm8-hgvv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5m59-6fm8-hgvv.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:11Z"}]}}],"modified":"2026-10-03T17:25:08.472408650Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:99af7c98-67f0-4568-9944-b12b8dabc2b9","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5m59-6fm8-hgvv","advisory_id":"99af7c98-67f0-4568-9944-b12b8dabc2b9","event_types":["advisory"],"published_at":"2026-10-26T11:31:05.872911+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:31+00:00","detail_url":"/events/79974"},"members":[{"id":79974,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5m59-6fm8-hgvv","summary":"CGA-5m59-6fm8-hgvv","evidence":"osv:CGA-5m59-6fm8-hgvv","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5m59-6fm8-hgvv","aliases":["CGA-5m59-6fm8-hgvv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5m59-6fm8-hgvv.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:11Z"}]}}],"modified":"2026-10-03T17:25:08.472408650Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:99af7c98-67f0-4568-9944-b12b8dabc2b9","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5m59-6fm8-hgvv","advisory_id":"99af7c98-67f0-4568-9944-b12b8dabc2b9","event_types":["advisory"],"published_at":"2026-10-26T11:31:05.872911+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:31+00:00","detail_url":"/events/79974"}]}},{"id":74562,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-7jmh-prf3-57ph","summary":"CGA-7jmh-prf3-57ph","evidence":"osv:CGA-7jmh-prf3-57ph","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7jmh-prf3-57ph","aliases":["CGA-7jmh-prf3-57ph"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7jmh-prf3-57ph.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:07Z"}]}}],"modified":"2026-10-03T17:25:02.879643348Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b9c061b9-059d-460f-9114-62ce2bb02102","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7jmh-prf3-57ph","advisory_id":"b9c061b9-059d-460f-9114-62ce2bb02102","event_types":["advisory"],"published_at":"2026-10-26T11:20:28.525212+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:32+00:00","detail_url":"/advisories/advisory%3Ab9c061b9-059d-460f-9114-62ce2bb02102","group":{"id":"advisory:b9c061b9-059d-460f-9114-62ce2bb02102","revision":1,"primary_event_id":79890,"change":"published","superseded_by":[],"changed":{"id":79890,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-7jmh-prf3-57ph","summary":"CGA-7jmh-prf3-57ph","evidence":"osv:CGA-7jmh-prf3-57ph","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7jmh-prf3-57ph","aliases":["CGA-7jmh-prf3-57ph"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7jmh-prf3-57ph.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:07Z"}]}}],"modified":"2026-10-03T17:25:02.879643348Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b9c061b9-059d-460f-9114-62ce2bb02102","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7jmh-prf3-57ph","advisory_id":"b9c061b9-059d-460f-9114-62ce2bb02102","event_types":["advisory"],"published_at":"2026-10-26T11:20:28.525212+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:32+00:00","detail_url":"/events/79890"},"members":[{"id":79890,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-7jmh-prf3-57ph","summary":"CGA-7jmh-prf3-57ph","evidence":"osv:CGA-7jmh-prf3-57ph","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-7jmh-prf3-57ph","aliases":["CGA-7jmh-prf3-57ph"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7jmh-prf3-57ph.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:07Z"}]}}],"modified":"2026-10-03T17:25:02.879643348Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b9c061b9-059d-460f-9114-62ce2bb02102","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7jmh-prf3-57ph","advisory_id":"b9c061b9-059d-460f-9114-62ce2bb02102","event_types":["advisory"],"published_at":"2026-10-26T11:20:28.525212+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:32+00:00","detail_url":"/events/79890"}]}},{"id":73164,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-9cxr-53vw-2xfm","summary":"CGA-9cxr-53vw-2xfm","evidence":"osv:CGA-9cxr-53vw-2xfm","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9cxr-53vw-2xfm","aliases":["CGA-9cxr-53vw-2xfm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9cxr-53vw-2xfm.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:07Z"}]}}],"modified":"2026-10-03T10:32:52.700037011Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:10ff7949-e3ef-4fd0-8c20-84c6e909e840","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9cxr-53vw-2xfm","advisory_id":"10ff7949-e3ef-4fd0-8c20-84c6e909e840","event_types":["advisory"],"published_at":"2026-10-26T03:36:44.236778+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/advisories/advisory%3A10ff7949-e3ef-4fd0-8c20-84c6e909e840","group":{"id":"advisory:10ff7949-e3ef-4fd0-8c20-84c6e909e840","revision":1,"primary_event_id":75169,"change":"published","superseded_by":[],"changed":{"id":75169,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-9cxr-53vw-2xfm","summary":"CGA-9cxr-53vw-2xfm","evidence":"osv:CGA-9cxr-53vw-2xfm","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9cxr-53vw-2xfm","aliases":["CGA-9cxr-53vw-2xfm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9cxr-53vw-2xfm.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:07Z"}]}}],"modified":"2026-10-03T10:32:52.700037011Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:10ff7949-e3ef-4fd0-8c20-84c6e909e840","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9cxr-53vw-2xfm","advisory_id":"10ff7949-e3ef-4fd0-8c20-84c6e909e840","event_types":["advisory"],"published_at":"2026-10-26T03:36:44.236778+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/events/75169"},"members":[{"id":75169,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-9cxr-53vw-2xfm","summary":"CGA-9cxr-53vw-2xfm","evidence":"osv:CGA-9cxr-53vw-2xfm","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9cxr-53vw-2xfm","aliases":["CGA-9cxr-53vw-2xfm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9cxr-53vw-2xfm.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:07Z"}]}}],"modified":"2026-10-03T10:32:52.700037011Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:10ff7949-e3ef-4fd0-8c20-84c6e909e840","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9cxr-53vw-2xfm","advisory_id":"10ff7949-e3ef-4fd0-8c20-84c6e909e840","event_types":["advisory"],"published_at":"2026-10-26T03:36:44.236778+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/events/75169"}]}},{"id":73141,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-x3m7-h952-ww7p","summary":"CGA-x3m7-h952-ww7p","evidence":"osv:CGA-x3m7-h952-ww7p","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-x3m7-h952-ww7p","aliases":["CGA-x3m7-h952-ww7p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x3m7-h952-ww7p.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:32:50.028724301Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a3315c09-b1e1-4857-8921-c161a35349aa","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x3m7-h952-ww7p","advisory_id":"a3315c09-b1e1-4857-8921-c161a35349aa","event_types":["advisory"],"published_at":"2026-10-26T03:19:49.548104+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/advisories/advisory%3Aa3315c09-b1e1-4857-8921-c161a35349aa","group":{"id":"advisory:a3315c09-b1e1-4857-8921-c161a35349aa","revision":1,"primary_event_id":75018,"change":"published","superseded_by":[],"changed":{"id":75018,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-x3m7-h952-ww7p","summary":"CGA-x3m7-h952-ww7p","evidence":"osv:CGA-x3m7-h952-ww7p","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-x3m7-h952-ww7p","aliases":["CGA-x3m7-h952-ww7p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x3m7-h952-ww7p.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:32:50.028724301Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a3315c09-b1e1-4857-8921-c161a35349aa","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x3m7-h952-ww7p","advisory_id":"a3315c09-b1e1-4857-8921-c161a35349aa","event_types":["advisory"],"published_at":"2026-10-26T03:19:49.548104+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/events/75018"},"members":[{"id":75018,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-x3m7-h952-ww7p","summary":"CGA-x3m7-h952-ww7p","evidence":"osv:CGA-x3m7-h952-ww7p","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-x3m7-h952-ww7p","aliases":["CGA-x3m7-h952-ww7p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x3m7-h952-ww7p.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:32:50.028724301Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a3315c09-b1e1-4857-8921-c161a35349aa","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x3m7-h952-ww7p","advisory_id":"a3315c09-b1e1-4857-8921-c161a35349aa","event_types":["advisory"],"published_at":"2026-10-26T03:19:49.548104+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/events/75018"}]}},{"id":73039,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-p694-q8wc-h7pp","summary":"CGA-p694-q8wc-h7pp","evidence":"osv:CGA-p694-q8wc-h7pp","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-p694-q8wc-h7pp","aliases":["CGA-p694-q8wc-h7pp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p694-q8wc-h7pp.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:09Z"}]}}],"modified":"2026-10-03T10:32:45.530868895Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e0fe8626-be70-4f7e-92b6-9332c8455ee0","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p694-q8wc-h7pp","advisory_id":"e0fe8626-be70-4f7e-92b6-9332c8455ee0","event_types":["advisory"],"published_at":"2026-10-26T02:29:15.63466+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/advisories/advisory%3Ae0fe8626-be70-4f7e-92b6-9332c8455ee0","group":{"id":"advisory:e0fe8626-be70-4f7e-92b6-9332c8455ee0","revision":1,"primary_event_id":74505,"change":"published","superseded_by":[],"changed":{"id":74505,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-p694-q8wc-h7pp","summary":"CGA-p694-q8wc-h7pp","evidence":"osv:CGA-p694-q8wc-h7pp","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-p694-q8wc-h7pp","aliases":["CGA-p694-q8wc-h7pp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p694-q8wc-h7pp.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:09Z"}]}}],"modified":"2026-10-03T10:32:45.530868895Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e0fe8626-be70-4f7e-92b6-9332c8455ee0","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p694-q8wc-h7pp","advisory_id":"e0fe8626-be70-4f7e-92b6-9332c8455ee0","event_types":["advisory"],"published_at":"2026-10-26T02:29:15.63466+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/events/74505"},"members":[{"id":74505,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-p694-q8wc-h7pp","summary":"CGA-p694-q8wc-h7pp","evidence":"osv:CGA-p694-q8wc-h7pp","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-p694-q8wc-h7pp","aliases":["CGA-p694-q8wc-h7pp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p694-q8wc-h7pp.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:09Z"}]}}],"modified":"2026-10-03T10:32:45.530868895Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e0fe8626-be70-4f7e-92b6-9332c8455ee0","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p694-q8wc-h7pp","advisory_id":"e0fe8626-be70-4f7e-92b6-9332c8455ee0","event_types":["advisory"],"published_at":"2026-10-26T02:29:15.63466+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/events/74505"}]}},{"id":73027,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-mr7p-f445-vqrc","summary":"CGA-mr7p-f445-vqrc","evidence":"osv:CGA-mr7p-f445-vqrc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mr7p-f445-vqrc","aliases":["CGA-mr7p-f445-vqrc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mr7p-f445-vqrc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:09Z"}]}}],"modified":"2026-10-03T10:32:45.234915165Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25e79e31-5031-4ee1-90d3-3e1d8d107af6","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mr7p-f445-vqrc","advisory_id":"25e79e31-5031-4ee1-90d3-3e1d8d107af6","event_types":["advisory"],"published_at":"2026-10-26T02:23:15.260237+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/advisories/advisory%3A25e79e31-5031-4ee1-90d3-3e1d8d107af6","group":{"id":"advisory:25e79e31-5031-4ee1-90d3-3e1d8d107af6","revision":1,"primary_event_id":74444,"change":"published","superseded_by":[],"changed":{"id":74444,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-mr7p-f445-vqrc","summary":"CGA-mr7p-f445-vqrc","evidence":"osv:CGA-mr7p-f445-vqrc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mr7p-f445-vqrc","aliases":["CGA-mr7p-f445-vqrc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mr7p-f445-vqrc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:09Z"}]}}],"modified":"2026-10-03T10:32:45.234915165Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25e79e31-5031-4ee1-90d3-3e1d8d107af6","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mr7p-f445-vqrc","advisory_id":"25e79e31-5031-4ee1-90d3-3e1d8d107af6","event_types":["advisory"],"published_at":"2026-10-26T02:23:15.260237+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/events/74444"},"members":[{"id":74444,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-mr7p-f445-vqrc","summary":"CGA-mr7p-f445-vqrc","evidence":"osv:CGA-mr7p-f445-vqrc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mr7p-f445-vqrc","aliases":["CGA-mr7p-f445-vqrc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mr7p-f445-vqrc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:09Z"}]}}],"modified":"2026-10-03T10:32:45.234915165Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:25e79e31-5031-4ee1-90d3-3e1d8d107af6","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mr7p-f445-vqrc","advisory_id":"25e79e31-5031-4ee1-90d3-3e1d8d107af6","event_types":["advisory"],"published_at":"2026-10-26T02:23:15.260237+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/events/74444"}]}},{"id":73008,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-m437-qqfx-g597","summary":"CGA-m437-qqfx-g597","evidence":"osv:CGA-m437-qqfx-g597","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m437-qqfx-g597","aliases":["CGA-m437-qqfx-g597"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m437-qqfx-g597.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:10Z"}]}}],"modified":"2026-10-03T10:32:44.152761182Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d5415fbe-e811-4a51-be7d-4034127259ef","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m437-qqfx-g597","advisory_id":"d5415fbe-e811-4a51-be7d-4034127259ef","event_types":["advisory"],"published_at":"2026-10-26T02:18:02.09115+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/advisories/advisory%3Ad5415fbe-e811-4a51-be7d-4034127259ef","group":{"id":"advisory:d5415fbe-e811-4a51-be7d-4034127259ef","revision":1,"primary_event_id":74377,"change":"published","superseded_by":[],"changed":{"id":74377,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-m437-qqfx-g597","summary":"CGA-m437-qqfx-g597","evidence":"osv:CGA-m437-qqfx-g597","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m437-qqfx-g597","aliases":["CGA-m437-qqfx-g597"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m437-qqfx-g597.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:10Z"}]}}],"modified":"2026-10-03T10:32:44.152761182Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d5415fbe-e811-4a51-be7d-4034127259ef","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m437-qqfx-g597","advisory_id":"d5415fbe-e811-4a51-be7d-4034127259ef","event_types":["advisory"],"published_at":"2026-10-26T02:18:02.09115+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/events/74377"},"members":[{"id":74377,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-m437-qqfx-g597","summary":"CGA-m437-qqfx-g597","evidence":"osv:CGA-m437-qqfx-g597","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-m437-qqfx-g597","aliases":["CGA-m437-qqfx-g597"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m437-qqfx-g597.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:10Z"}]}}],"modified":"2026-10-03T10:32:44.152761182Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d5415fbe-e811-4a51-be7d-4034127259ef","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m437-qqfx-g597","advisory_id":"d5415fbe-e811-4a51-be7d-4034127259ef","event_types":["advisory"],"published_at":"2026-10-26T02:18:02.09115+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/events/74377"}]}},{"id":72902,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-f85j-xqhj-m76g","summary":"CGA-f85j-xqhj-m76g","evidence":"osv:CGA-f85j-xqhj-m76g","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f85j-xqhj-m76g","aliases":["CGA-f85j-xqhj-m76g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f85j-xqhj-m76g.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:10Z"}]}}],"modified":"2026-10-03T10:32:39.938536940Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3bdd7d35-83df-4df6-97c3-3a1285589228","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f85j-xqhj-m76g","advisory_id":"3bdd7d35-83df-4df6-97c3-3a1285589228","event_types":["advisory"],"published_at":"2026-10-26T01:32:41.493842+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/advisories/advisory%3A3bdd7d35-83df-4df6-97c3-3a1285589228","group":{"id":"advisory:3bdd7d35-83df-4df6-97c3-3a1285589228","revision":1,"primary_event_id":73901,"change":"published","superseded_by":[],"changed":{"id":73901,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-f85j-xqhj-m76g","summary":"CGA-f85j-xqhj-m76g","evidence":"osv:CGA-f85j-xqhj-m76g","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f85j-xqhj-m76g","aliases":["CGA-f85j-xqhj-m76g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f85j-xqhj-m76g.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:10Z"}]}}],"modified":"2026-10-03T10:32:39.938536940Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3bdd7d35-83df-4df6-97c3-3a1285589228","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f85j-xqhj-m76g","advisory_id":"3bdd7d35-83df-4df6-97c3-3a1285589228","event_types":["advisory"],"published_at":"2026-10-26T01:32:41.493842+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/events/73901"},"members":[{"id":73901,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-f85j-xqhj-m76g","summary":"CGA-f85j-xqhj-m76g","evidence":"osv:CGA-f85j-xqhj-m76g","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f85j-xqhj-m76g","aliases":["CGA-f85j-xqhj-m76g"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f85j-xqhj-m76g.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:10Z"}]}}],"modified":"2026-10-03T10:32:39.938536940Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3bdd7d35-83df-4df6-97c3-3a1285589228","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f85j-xqhj-m76g","advisory_id":"3bdd7d35-83df-4df6-97c3-3a1285589228","event_types":["advisory"],"published_at":"2026-10-26T01:32:41.493842+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:18+00:00","detail_url":"/events/73901"}]}},{"id":72865,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-9j6h-cjwx-wrjc","summary":"CGA-9j6h-cjwx-wrjc","evidence":"osv:CGA-9j6h-cjwx-wrjc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9j6h-cjwx-wrjc","aliases":["CGA-9j6h-cjwx-wrjc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9j6h-cjwx-wrjc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:32:38.357295791Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ea29c4f6-2f1e-4215-b1df-12016921c029","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9j6h-cjwx-wrjc","advisory_id":"ea29c4f6-2f1e-4215-b1df-12016921c029","event_types":["advisory"],"published_at":"2026-10-26T01:20:07.947369+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/advisories/advisory%3Aea29c4f6-2f1e-4215-b1df-12016921c029","group":{"id":"advisory:ea29c4f6-2f1e-4215-b1df-12016921c029","revision":1,"primary_event_id":73752,"change":"published","superseded_by":[],"changed":{"id":73752,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-9j6h-cjwx-wrjc","summary":"CGA-9j6h-cjwx-wrjc","evidence":"osv:CGA-9j6h-cjwx-wrjc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9j6h-cjwx-wrjc","aliases":["CGA-9j6h-cjwx-wrjc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9j6h-cjwx-wrjc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:32:38.357295791Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ea29c4f6-2f1e-4215-b1df-12016921c029","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9j6h-cjwx-wrjc","advisory_id":"ea29c4f6-2f1e-4215-b1df-12016921c029","event_types":["advisory"],"published_at":"2026-10-26T01:20:07.947369+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/events/73752"},"members":[{"id":73752,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-9j6h-cjwx-wrjc","summary":"CGA-9j6h-cjwx-wrjc","evidence":"osv:CGA-9j6h-cjwx-wrjc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-9j6h-cjwx-wrjc","aliases":["CGA-9j6h-cjwx-wrjc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9j6h-cjwx-wrjc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:32:38.357295791Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ea29c4f6-2f1e-4215-b1df-12016921c029","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9j6h-cjwx-wrjc","advisory_id":"ea29c4f6-2f1e-4215-b1df-12016921c029","event_types":["advisory"],"published_at":"2026-10-26T01:20:07.947369+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/events/73752"}]}},{"id":72731,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-67w4-c5fq-pvph","summary":"CGA-67w4-c5fq-pvph","evidence":"osv:CGA-67w4-c5fq-pvph","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-67w4-c5fq-pvph","aliases":["CGA-67w4-c5fq-pvph"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67w4-c5fq-pvph.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:07Z"}]}}],"modified":"2026-10-03T10:32:34.050565473Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:64a0e316-3827-4f28-9199-145f8894388e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67w4-c5fq-pvph","advisory_id":"64a0e316-3827-4f28-9199-145f8894388e","event_types":["advisory"],"published_at":"2026-10-26T00:55:03.791836+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/advisories/advisory%3A64a0e316-3827-4f28-9199-145f8894388e","group":{"id":"advisory:64a0e316-3827-4f28-9199-145f8894388e","revision":1,"primary_event_id":73481,"change":"published","superseded_by":[],"changed":{"id":73481,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-67w4-c5fq-pvph","summary":"CGA-67w4-c5fq-pvph","evidence":"osv:CGA-67w4-c5fq-pvph","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-67w4-c5fq-pvph","aliases":["CGA-67w4-c5fq-pvph"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67w4-c5fq-pvph.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:07Z"}]}}],"modified":"2026-10-03T10:32:34.050565473Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:64a0e316-3827-4f28-9199-145f8894388e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67w4-c5fq-pvph","advisory_id":"64a0e316-3827-4f28-9199-145f8894388e","event_types":["advisory"],"published_at":"2026-10-26T00:55:03.791836+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/events/73481"},"members":[{"id":73481,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-67w4-c5fq-pvph","summary":"CGA-67w4-c5fq-pvph","evidence":"osv:CGA-67w4-c5fq-pvph","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-67w4-c5fq-pvph","aliases":["CGA-67w4-c5fq-pvph"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67w4-c5fq-pvph.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:07Z"}]}}],"modified":"2026-10-03T10:32:34.050565473Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:64a0e316-3827-4f28-9199-145f8894388e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67w4-c5fq-pvph","advisory_id":"64a0e316-3827-4f28-9199-145f8894388e","event_types":["advisory"],"published_at":"2026-10-26T00:55:03.791836+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:16+00:00","detail_url":"/events/73481"}]}},{"id":72492,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-p7r8-95r4-9mj9","summary":"CGA-p7r8-95r4-9mj9","evidence":"osv:CGA-p7r8-95r4-9mj9","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-p7r8-95r4-9mj9","aliases":["CGA-p7r8-95r4-9mj9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p7r8-95r4-9mj9.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:30:12.728235138Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4c608fc3-86d5-42c9-9a57-166771af7220","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p7r8-95r4-9mj9","advisory_id":"4c608fc3-86d5-42c9-9a57-166771af7220","event_types":["advisory"],"published_at":"2026-10-26T00:24:24.717065+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/advisories/advisory%3A4c608fc3-86d5-42c9-9a57-166771af7220","group":{"id":"advisory:4c608fc3-86d5-42c9-9a57-166771af7220","revision":1,"primary_event_id":73140,"change":"published","superseded_by":[],"changed":{"id":73140,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-p7r8-95r4-9mj9","summary":"CGA-p7r8-95r4-9mj9","evidence":"osv:CGA-p7r8-95r4-9mj9","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-p7r8-95r4-9mj9","aliases":["CGA-p7r8-95r4-9mj9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p7r8-95r4-9mj9.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:30:12.728235138Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4c608fc3-86d5-42c9-9a57-166771af7220","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p7r8-95r4-9mj9","advisory_id":"4c608fc3-86d5-42c9-9a57-166771af7220","event_types":["advisory"],"published_at":"2026-10-26T00:24:24.717065+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/events/73140"},"members":[{"id":73140,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-p7r8-95r4-9mj9","summary":"CGA-p7r8-95r4-9mj9","evidence":"osv:CGA-p7r8-95r4-9mj9","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-p7r8-95r4-9mj9","aliases":["CGA-p7r8-95r4-9mj9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p7r8-95r4-9mj9.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:41:08Z"}]}}],"modified":"2026-10-03T10:30:12.728235138Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4c608fc3-86d5-42c9-9a57-166771af7220","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p7r8-95r4-9mj9","advisory_id":"4c608fc3-86d5-42c9-9a57-166771af7220","event_types":["advisory"],"published_at":"2026-10-26T00:24:24.717065+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:17+00:00","detail_url":"/events/73140"}]}},{"id":71900,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-mmjj-wqm4-pvjp","summary":"CGA-mmjj-wqm4-pvjp","evidence":"osv:CGA-mmjj-wqm4-pvjp","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mmjj-wqm4-pvjp","aliases":["CGA-mmjj-wqm4-pvjp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mmjj-wqm4-pvjp.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:08Z"}]}}],"modified":"2026-10-02T23:01:38.586101415Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3b75711d-5929-4d72-aee7-a26ef5831aaf","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mmjj-wqm4-pvjp","advisory_id":"3b75711d-5929-4d72-aee7-a26ef5831aaf","event_types":["advisory"],"published_at":"2026-10-25T23:49:33.790706+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:30+00:00","detail_url":"/advisories/advisory%3A3b75711d-5929-4d72-aee7-a26ef5831aaf","group":{"id":"advisory:3b75711d-5929-4d72-aee7-a26ef5831aaf","revision":1,"primary_event_id":72416,"change":"published","superseded_by":[],"changed":{"id":72416,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-mmjj-wqm4-pvjp","summary":"CGA-mmjj-wqm4-pvjp","evidence":"osv:CGA-mmjj-wqm4-pvjp","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mmjj-wqm4-pvjp","aliases":["CGA-mmjj-wqm4-pvjp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mmjj-wqm4-pvjp.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:08Z"}]}}],"modified":"2026-10-02T23:01:38.586101415Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3b75711d-5929-4d72-aee7-a26ef5831aaf","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mmjj-wqm4-pvjp","advisory_id":"3b75711d-5929-4d72-aee7-a26ef5831aaf","event_types":["advisory"],"published_at":"2026-10-25T23:49:33.790706+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:30+00:00","detail_url":"/events/72416"},"members":[{"id":72416,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-mmjj-wqm4-pvjp","summary":"CGA-mmjj-wqm4-pvjp","evidence":"osv:CGA-mmjj-wqm4-pvjp","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-mmjj-wqm4-pvjp","aliases":["CGA-mmjj-wqm4-pvjp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mmjj-wqm4-pvjp.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:08Z"}]}}],"modified":"2026-10-02T23:01:38.586101415Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3b75711d-5929-4d72-aee7-a26ef5831aaf","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mmjj-wqm4-pvjp","advisory_id":"3b75711d-5929-4d72-aee7-a26ef5831aaf","event_types":["advisory"],"published_at":"2026-10-25T23:49:33.790706+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:30+00:00","detail_url":"/events/72416"}]}},{"id":71604,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-hwj7-vf82-ffrf","summary":"CGA-hwj7-vf82-ffrf","evidence":"osv:CGA-hwj7-vf82-ffrf","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-hwj7-vf82-ffrf","aliases":["CGA-hwj7-vf82-ffrf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hwj7-vf82-ffrf.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:08Z"}]}}],"modified":"2026-10-02T23:01:08.688859774Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:cacbb701-f9ca-4afc-beba-9a26a204f6c1","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hwj7-vf82-ffrf","advisory_id":"cacbb701-f9ca-4afc-beba-9a26a204f6c1","event_types":["advisory"],"published_at":"2026-10-25T23:22:19.510872+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:29+00:00","detail_url":"/advisories/advisory%3Acacbb701-f9ca-4afc-beba-9a26a204f6c1","group":{"id":"advisory:cacbb701-f9ca-4afc-beba-9a26a204f6c1","revision":1,"primary_event_id":72023,"change":"published","superseded_by":[],"changed":{"id":72023,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-hwj7-vf82-ffrf","summary":"CGA-hwj7-vf82-ffrf","evidence":"osv:CGA-hwj7-vf82-ffrf","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-hwj7-vf82-ffrf","aliases":["CGA-hwj7-vf82-ffrf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hwj7-vf82-ffrf.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:08Z"}]}}],"modified":"2026-10-02T23:01:08.688859774Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:cacbb701-f9ca-4afc-beba-9a26a204f6c1","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hwj7-vf82-ffrf","advisory_id":"cacbb701-f9ca-4afc-beba-9a26a204f6c1","event_types":["advisory"],"published_at":"2026-10-25T23:22:19.510872+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:29+00:00","detail_url":"/events/72023"},"members":[{"id":72023,"cve_ids":["CVE-2026-102278"],"payload":{"kind":"advisory","title":"CGA-hwj7-vf82-ffrf","summary":"CGA-hwj7-vf82-ffrf","evidence":"osv:CGA-hwj7-vf82-ffrf","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-hwj7-vf82-ffrf","aliases":["CGA-hwj7-vf82-ffrf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hwj7-vf82-ffrf.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:08Z"}]}}],"modified":"2026-10-02T23:01:08.688859774Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:cacbb701-f9ca-4afc-beba-9a26a204f6c1","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102278","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102278","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102278","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.11","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.8","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.6","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.20","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hwj7-vf82-ffrf","advisory_id":"cacbb701-f9ca-4afc-beba-9a26a204f6c1","event_types":["advisory"],"published_at":"2026-10-25T23:22:19.510872+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:29+00:00","detail_url":"/events/72023"}]}},{"id":71568,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5f7v-4wg6-c48w","summary":"CGA-5f7v-4wg6-c48w","evidence":"osv:CGA-5f7v-4wg6-c48w","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5f7v-4wg6-c48w","aliases":["CGA-5f7v-4wg6-c48w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5f7v-4wg6-c48w.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:01:06.108519280Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42ce658c-a18c-4488-9637-b9a8e773bf1e","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5f7v-4wg6-c48w","advisory_id":"42ce658c-a18c-4488-9637-b9a8e773bf1e","event_types":["advisory"],"published_at":"2026-10-25T23:19:52.628917+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:29+00:00","detail_url":"/advisories/advisory%3A42ce658c-a18c-4488-9637-b9a8e773bf1e","group":{"id":"advisory:42ce658c-a18c-4488-9637-b9a8e773bf1e","revision":1,"primary_event_id":71985,"change":"published","superseded_by":[],"changed":{"id":71985,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5f7v-4wg6-c48w","summary":"CGA-5f7v-4wg6-c48w","evidence":"osv:CGA-5f7v-4wg6-c48w","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5f7v-4wg6-c48w","aliases":["CGA-5f7v-4wg6-c48w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5f7v-4wg6-c48w.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:01:06.108519280Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42ce658c-a18c-4488-9637-b9a8e773bf1e","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5f7v-4wg6-c48w","advisory_id":"42ce658c-a18c-4488-9637-b9a8e773bf1e","event_types":["advisory"],"published_at":"2026-10-25T23:19:52.628917+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:29+00:00","detail_url":"/events/71985"},"members":[{"id":71985,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-5f7v-4wg6-c48w","summary":"CGA-5f7v-4wg6-c48w","evidence":"osv:CGA-5f7v-4wg6-c48w","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-5f7v-4wg6-c48w","aliases":["CGA-5f7v-4wg6-c48w"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5f7v-4wg6-c48w.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:01:06.108519280Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:42ce658c-a18c-4488-9637-b9a8e773bf1e","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5f7v-4wg6-c48w","advisory_id":"42ce658c-a18c-4488-9637-b9a8e773bf1e","event_types":["advisory"],"published_at":"2026-10-25T23:19:52.628917+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:29+00:00","detail_url":"/events/71985"}]}},{"id":71338,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-9r9m-29rq-3qjg","summary":"CGA-9r9m-29rq-3qjg","evidence":"osv:CGA-9r9m-29rq-3qjg","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9r9m-29rq-3qjg","aliases":["CGA-9r9m-29rq-3qjg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9r9m-29rq-3qjg.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:09Z"}]}}],"modified":"2026-10-02T23:00:42.610978933Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fd9a096e-bad9-4fc1-9095-2639f092dc62","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9r9m-29rq-3qjg","advisory_id":"fd9a096e-bad9-4fc1-9095-2639f092dc62","event_types":["advisory"],"published_at":"2026-10-25T23:03:23.866143+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:30+00:00","detail_url":"/advisories/advisory%3Afd9a096e-bad9-4fc1-9095-2639f092dc62","group":{"id":"advisory:fd9a096e-bad9-4fc1-9095-2639f092dc62","revision":1,"primary_event_id":71727,"change":"published","superseded_by":[],"changed":{"id":71727,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-9r9m-29rq-3qjg","summary":"CGA-9r9m-29rq-3qjg","evidence":"osv:CGA-9r9m-29rq-3qjg","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9r9m-29rq-3qjg","aliases":["CGA-9r9m-29rq-3qjg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9r9m-29rq-3qjg.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:09Z"}]}}],"modified":"2026-10-02T23:00:42.610978933Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fd9a096e-bad9-4fc1-9095-2639f092dc62","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9r9m-29rq-3qjg","advisory_id":"fd9a096e-bad9-4fc1-9095-2639f092dc62","event_types":["advisory"],"published_at":"2026-10-25T23:03:23.866143+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:30+00:00","detail_url":"/events/71727"},"members":[{"id":71727,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-9r9m-29rq-3qjg","summary":"CGA-9r9m-29rq-3qjg","evidence":"osv:CGA-9r9m-29rq-3qjg","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9r9m-29rq-3qjg","aliases":["CGA-9r9m-29rq-3qjg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9r9m-29rq-3qjg.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/node/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:09Z"}]}}],"modified":"2026-10-02T23:00:42.610978933Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:fd9a096e-bad9-4fc1-9095-2639f092dc62","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9r9m-29rq-3qjg","advisory_id":"fd9a096e-bad9-4fc1-9095-2639f092dc62","event_types":["advisory"],"published_at":"2026-10-25T23:03:23.866143+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:30+00:00","detail_url":"/events/71727"}]}},{"id":71207,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-c7mg-55cg-pjmc","summary":"CGA-c7mg-55cg-pjmc","evidence":"osv:CGA-c7mg-55cg-pjmc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c7mg-55cg-pjmc","aliases":["CGA-c7mg-55cg-pjmc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c7mg-55cg-pjmc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:09Z"}]}}],"modified":"2026-10-02T23:00:29.103076845Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f4ba8a23-1256-4c7b-81f1-1f0b59b9adb8","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c7mg-55cg-pjmc","advisory_id":"f4ba8a23-1256-4c7b-81f1-1f0b59b9adb8","event_types":["advisory"],"published_at":"2026-10-25T22:56:30.104205+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/advisories/advisory%3Af4ba8a23-1256-4c7b-81f1-1f0b59b9adb8","group":{"id":"advisory:f4ba8a23-1256-4c7b-81f1-1f0b59b9adb8","revision":1,"primary_event_id":71592,"change":"published","superseded_by":[],"changed":{"id":71592,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-c7mg-55cg-pjmc","summary":"CGA-c7mg-55cg-pjmc","evidence":"osv:CGA-c7mg-55cg-pjmc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c7mg-55cg-pjmc","aliases":["CGA-c7mg-55cg-pjmc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c7mg-55cg-pjmc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:09Z"}]}}],"modified":"2026-10-02T23:00:29.103076845Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f4ba8a23-1256-4c7b-81f1-1f0b59b9adb8","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c7mg-55cg-pjmc","advisory_id":"f4ba8a23-1256-4c7b-81f1-1f0b59b9adb8","event_types":["advisory"],"published_at":"2026-10-25T22:56:30.104205+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/events/71592"},"members":[{"id":71592,"cve_ids":["CVE-2026-102277"],"payload":{"kind":"advisory","title":"CGA-c7mg-55cg-pjmc","summary":"CGA-c7mg-55cg-pjmc","evidence":"osv:CGA-c7mg-55cg-pjmc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c7mg-55cg-pjmc","aliases":["CGA-c7mg-55cg-pjmc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c7mg-55cg-pjmc.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:09Z"}]}}],"modified":"2026-10-02T23:00:29.103076845Z","provider":"osv","upstream":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102277.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"]},"related_cves":[{"value":"CVE-2026-102277","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f4ba8a23-1256-4c7b-81f1-1f0b59b9adb8","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-102277","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102277","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c7mg-55cg-pjmc","advisory_id":"f4ba8a23-1256-4c7b-81f1-1f0b59b9adb8","event_types":["advisory"],"published_at":"2026-10-25T22:56:30.104205+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/events/71592"}]}},{"id":71067,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-3hhv-qc6c-46jj","summary":"CGA-3hhv-qc6c-46jj","evidence":"osv:CGA-3hhv-qc6c-46jj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3hhv-qc6c-46jj","aliases":["CGA-3hhv-qc6c-46jj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hhv-qc6c-46jj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:00:12.955277168Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hhv-qc6c-46jj","advisory_id":"c3c3c9a2-769c-445c-a429-6c90b93be634","event_types":["advisory"],"published_at":"2026-10-25T22:49:14.925024+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/advisories/advisory%3Ac3c3c9a2-769c-445c-a429-6c90b93be634","group":{"id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","revision":1,"primary_event_id":71441,"change":"published","superseded_by":[],"changed":{"id":71441,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-3hhv-qc6c-46jj","summary":"CGA-3hhv-qc6c-46jj","evidence":"osv:CGA-3hhv-qc6c-46jj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3hhv-qc6c-46jj","aliases":["CGA-3hhv-qc6c-46jj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hhv-qc6c-46jj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:00:12.955277168Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hhv-qc6c-46jj","advisory_id":"c3c3c9a2-769c-445c-a429-6c90b93be634","event_types":["advisory"],"published_at":"2026-10-25T22:49:14.925024+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/events/71441"},"members":[{"id":71441,"cve_ids":["CVE-2026-102276"],"payload":{"kind":"advisory","title":"CGA-3hhv-qc6c-46jj","summary":"CGA-3hhv-qc6c-46jj","evidence":"osv:CGA-3hhv-qc6c-46jj","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-3hhv-qc6c-46jj","aliases":["CGA-3hhv-qc6c-46jj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r3"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3hhv-qc6c-46jj.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@5.0.9","component_type":"npm","component_version":"5.0.9","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:59:10Z"}]}}],"modified":"2026-10-02T23:00:12.955277168Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c3c3c9a2-769c-445c-a429-6c90b93be634","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102276","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"products":[{"name":{"value":"brace-expansion","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102276","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-102276","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"brace-expansion","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.0.10","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.0.7","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.1.5","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"brace-expansion","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.19","evidence":"/affected/3/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3hhv-qc6c-46jj","advisory_id":"c3c3c9a2-769c-445c-a429-6c90b93be634","event_types":["advisory"],"published_at":"2026-10-25T22:49:14.925024+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:28+00:00","detail_url":"/events/71441"}]}},{"id":69415,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-xjwr-f8wg-qjh9","summary":"CGA-xjwr-f8wg-qjh9","evidence":"osv:CGA-xjwr-f8wg-qjh9","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xjwr-f8wg-qjh9","aliases":["CGA-xjwr-f8wg-qjh9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xjwr-f8wg-qjh9.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/node_modules/fast-uri/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:04:08Z"}]}}],"modified":"2026-10-02T17:16:36.015737477Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b919f693-84cd-4c6b-bd52-aeabe2d144e6","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xjwr-f8wg-qjh9","advisory_id":"b919f693-84cd-4c6b-bd52-aeabe2d144e6","event_types":["advisory"],"published_at":"2026-10-25T21:58:19.422033+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:19+00:00","detail_url":"/advisories/advisory%3Ab919f693-84cd-4c6b-bd52-aeabe2d144e6","group":{"id":"advisory:b919f693-84cd-4c6b-bd52-aeabe2d144e6","revision":1,"primary_event_id":69785,"change":"published","superseded_by":[],"changed":{"id":69785,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-xjwr-f8wg-qjh9","summary":"CGA-xjwr-f8wg-qjh9","evidence":"osv:CGA-xjwr-f8wg-qjh9","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xjwr-f8wg-qjh9","aliases":["CGA-xjwr-f8wg-qjh9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xjwr-f8wg-qjh9.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/node_modules/fast-uri/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:04:08Z"}]}}],"modified":"2026-10-02T17:16:36.015737477Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b919f693-84cd-4c6b-bd52-aeabe2d144e6","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xjwr-f8wg-qjh9","advisory_id":"b919f693-84cd-4c6b-bd52-aeabe2d144e6","event_types":["advisory"],"published_at":"2026-10-25T21:58:19.422033+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:19+00:00","detail_url":"/events/69785"},"members":[{"id":69785,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-xjwr-f8wg-qjh9","summary":"CGA-xjwr-f8wg-qjh9","evidence":"osv:CGA-xjwr-f8wg-qjh9","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xjwr-f8wg-qjh9","aliases":["CGA-xjwr-f8wg-qjh9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xjwr-f8wg-qjh9.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/node_modules/fast-uri/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:04:08Z"}]}}],"modified":"2026-10-02T17:16:36.015737477Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b919f693-84cd-4c6b-bd52-aeabe2d144e6","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xjwr-f8wg-qjh9","advisory_id":"b919f693-84cd-4c6b-bd52-aeabe2d144e6","event_types":["advisory"],"published_at":"2026-10-25T21:58:19.422033+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:19+00:00","detail_url":"/events/69785"}]}},{"id":69040,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-7jw2-x3wv-p778","summary":"CGA-7jw2-x3wv-p778","evidence":"osv:CGA-7jw2-x3wv-p778","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7jw2-x3wv-p778","aliases":["CGA-7jw2-x3wv-p778"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7jw2-x3wv-p778.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:57:03Z"}]}}],"modified":"2026-10-02T17:16:19.131964444Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:801eaec7-a4d4-461e-97a1-bfd22815f587","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7jw2-x3wv-p778","advisory_id":"801eaec7-a4d4-461e-97a1-bfd22815f587","event_types":["advisory"],"published_at":"2026-10-25T21:51:11.729168+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:32+00:00","detail_url":"/advisories/advisory%3A801eaec7-a4d4-461e-97a1-bfd22815f587","group":{"id":"advisory:801eaec7-a4d4-461e-97a1-bfd22815f587","revision":1,"primary_event_id":69410,"change":"published","superseded_by":[],"changed":{"id":69410,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-7jw2-x3wv-p778","summary":"CGA-7jw2-x3wv-p778","evidence":"osv:CGA-7jw2-x3wv-p778","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7jw2-x3wv-p778","aliases":["CGA-7jw2-x3wv-p778"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7jw2-x3wv-p778.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:57:03Z"}]}}],"modified":"2026-10-02T17:16:19.131964444Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:801eaec7-a4d4-461e-97a1-bfd22815f587","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7jw2-x3wv-p778","advisory_id":"801eaec7-a4d4-461e-97a1-bfd22815f587","event_types":["advisory"],"published_at":"2026-10-25T21:51:11.729168+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:32+00:00","detail_url":"/events/69410"},"members":[{"id":69410,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-7jw2-x3wv-p778","summary":"CGA-7jw2-x3wv-p778","evidence":"osv:CGA-7jw2-x3wv-p778","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7jw2-x3wv-p778","aliases":["CGA-7jw2-x3wv-p778"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7jw2-x3wv-p778.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:57:03Z"}]}}],"modified":"2026-10-02T17:16:19.131964444Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:801eaec7-a4d4-461e-97a1-bfd22815f587","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7jw2-x3wv-p778","advisory_id":"801eaec7-a4d4-461e-97a1-bfd22815f587","event_types":["advisory"],"published_at":"2026-10-25T21:51:11.729168+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:32+00:00","detail_url":"/events/69410"}]}},{"id":68907,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-57cg-59p6-3pph","summary":"CGA-57cg-59p6-3pph","evidence":"osv:CGA-57cg-59p6-3pph","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-57cg-59p6-3pph","aliases":["CGA-57cg-59p6-3pph"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-57cg-59p6-3pph.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/node_modules/fast-uri/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:57:03Z"}]}}],"modified":"2026-10-02T17:15:57.320657641Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a2aa69f3-fa91-4464-a130-3649701203e1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-57cg-59p6-3pph","advisory_id":"a2aa69f3-fa91-4464-a130-3649701203e1","event_types":["advisory"],"published_at":"2026-10-25T21:48:54.58622+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:32+00:00","detail_url":"/advisories/advisory%3Aa2aa69f3-fa91-4464-a130-3649701203e1","group":{"id":"advisory:a2aa69f3-fa91-4464-a130-3649701203e1","revision":1,"primary_event_id":69277,"change":"published","superseded_by":[],"changed":{"id":69277,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-57cg-59p6-3pph","summary":"CGA-57cg-59p6-3pph","evidence":"osv:CGA-57cg-59p6-3pph","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-57cg-59p6-3pph","aliases":["CGA-57cg-59p6-3pph"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-57cg-59p6-3pph.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/node_modules/fast-uri/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:57:03Z"}]}}],"modified":"2026-10-02T17:15:57.320657641Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a2aa69f3-fa91-4464-a130-3649701203e1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-57cg-59p6-3pph","advisory_id":"a2aa69f3-fa91-4464-a130-3649701203e1","event_types":["advisory"],"published_at":"2026-10-25T21:48:54.58622+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:32+00:00","detail_url":"/events/69277"},"members":[{"id":69277,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-57cg-59p6-3pph","summary":"CGA-57cg-59p6-3pph","evidence":"osv:CGA-57cg-59p6-3pph","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-57cg-59p6-3pph","aliases":["CGA-57cg-59p6-3pph"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-57cg-59p6-3pph.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/node_modules/fast-uri/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:57:03Z"}]}}],"modified":"2026-10-02T17:15:57.320657641Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a2aa69f3-fa91-4464-a130-3649701203e1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-57cg-59p6-3pph","advisory_id":"a2aa69f3-fa91-4464-a130-3649701203e1","event_types":["advisory"],"published_at":"2026-10-25T21:48:54.58622+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:32+00:00","detail_url":"/events/69277"}]}},{"id":68752,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-2mfc-xcvr-3qpp","summary":"CGA-2mfc-xcvr-3qpp","evidence":"osv:CGA-2mfc-xcvr-3qpp","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2mfc-xcvr-3qpp","aliases":["CGA-2mfc-xcvr-3qpp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mfc-xcvr-3qpp.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:04:08Z"}]}}],"modified":"2026-10-02T17:15:15.620502939Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:79d64607-b769-4fc5-8145-c1704b5370aa","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mfc-xcvr-3qpp","advisory_id":"79d64607-b769-4fc5-8145-c1704b5370aa","event_types":["advisory"],"published_at":"2026-10-25T21:45:37.138301+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:19+00:00","detail_url":"/advisories/advisory%3A79d64607-b769-4fc5-8145-c1704b5370aa","group":{"id":"advisory:79d64607-b769-4fc5-8145-c1704b5370aa","revision":1,"primary_event_id":69122,"change":"published","superseded_by":[],"changed":{"id":69122,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-2mfc-xcvr-3qpp","summary":"CGA-2mfc-xcvr-3qpp","evidence":"osv:CGA-2mfc-xcvr-3qpp","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2mfc-xcvr-3qpp","aliases":["CGA-2mfc-xcvr-3qpp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mfc-xcvr-3qpp.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:04:08Z"}]}}],"modified":"2026-10-02T17:15:15.620502939Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:79d64607-b769-4fc5-8145-c1704b5370aa","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mfc-xcvr-3qpp","advisory_id":"79d64607-b769-4fc5-8145-c1704b5370aa","event_types":["advisory"],"published_at":"2026-10-25T21:45:37.138301+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:19+00:00","detail_url":"/events/69122"},"members":[{"id":69122,"cve_ids":["CVE-2026-86472"],"payload":{"kind":"advisory","title":"CGA-2mfc-xcvr-3qpp","summary":"CGA-2mfc-xcvr-3qpp","evidence":"osv:CGA-2mfc-xcvr-3qpp","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-2mfc-xcvr-3qpp","aliases":["CGA-2mfc-xcvr-3qpp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r2"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mfc-xcvr-3qpp.json"},"ecosystem_specific":{"components":[{"component_name":"fast-uri","component_purl":"pkg:npm/fast-uri@3.1.7","component_type":"npm","component_version":"3.1.7","component_location":"/usr/share/arangodb3/js/node/package-lock.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T10:04:08Z"}]}}],"modified":"2026-10-02T17:15:15.620502939Z","provider":"osv","upstream":["CVE-2026-86472","GHSA-hrr3-gc8f-f4qj"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86472.json","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472"]},"related_cves":[{"value":"CVE-2026-86472","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:79d64607-b769-4fc5-8145-c1704b5370aa","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mfc-xcvr-3qpp","advisory_id":"79d64607-b769-4fc5-8145-c1704b5370aa","event_types":["advisory"],"published_at":"2026-10-25T21:45:37.138301+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:19+00:00","detail_url":"/events/69122"}]}},{"id":66590,"cve_ids":["CVE-2026-17495"],"payload":{"kind":"advisory","title":"CGA-p2cv-gwc5-w2gc","summary":"CGA-p2cv-gwc5-w2gc","evidence":"osv:CGA-p2cv-gwc5-w2gc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-p2cv-gwc5-w2gc","aliases":["CGA-p2cv-gwc5-w2gc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r1"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p2cv-gwc5-w2gc.json"},"ecosystem_specific":{"components":[{"component_name":"moment","component_purl":"pkg:npm/moment@2.30.1","component_type":"npm","component_version":"2.30.1","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:15:24Z"}]}}],"modified":"2026-10-02T05:17:36.480854848Z","provider":"osv","upstream":["CVE-2026-17495","GHSA-4p3w-j4w9-5jqw"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17495.json","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495"]},"related_cves":[{"value":"CVE-2026-17495","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:163c6a19-1342-443f-ae87-02fcbd2657d3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p2cv-gwc5-w2gc","advisory_id":"163c6a19-1342-443f-ae87-02fcbd2657d3","event_types":["advisory"],"published_at":"2026-10-25T21:02:23.671195+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:33+00:00","detail_url":"/advisories/advisory%3A163c6a19-1342-443f-ae87-02fcbd2657d3","group":{"id":"advisory:163c6a19-1342-443f-ae87-02fcbd2657d3","revision":1,"primary_event_id":66960,"change":"published","superseded_by":[],"changed":{"id":66960,"cve_ids":["CVE-2026-17495"],"payload":{"kind":"advisory","title":"CGA-p2cv-gwc5-w2gc","summary":"CGA-p2cv-gwc5-w2gc","evidence":"osv:CGA-p2cv-gwc5-w2gc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-p2cv-gwc5-w2gc","aliases":["CGA-p2cv-gwc5-w2gc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r1"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p2cv-gwc5-w2gc.json"},"ecosystem_specific":{"components":[{"component_name":"moment","component_purl":"pkg:npm/moment@2.30.1","component_type":"npm","component_version":"2.30.1","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:15:24Z"}]}}],"modified":"2026-10-02T05:17:36.480854848Z","provider":"osv","upstream":["CVE-2026-17495","GHSA-4p3w-j4w9-5jqw"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17495.json","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495"]},"related_cves":[{"value":"CVE-2026-17495","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:163c6a19-1342-443f-ae87-02fcbd2657d3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p2cv-gwc5-w2gc","advisory_id":"163c6a19-1342-443f-ae87-02fcbd2657d3","event_types":["advisory"],"published_at":"2026-10-25T21:02:23.671195+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:33+00:00","detail_url":"/events/66960"},"members":[{"id":66960,"cve_ids":["CVE-2026-17495"],"payload":{"kind":"advisory","title":"CGA-p2cv-gwc5-w2gc","summary":"CGA-p2cv-gwc5-w2gc","evidence":"osv:CGA-p2cv-gwc5-w2gc","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-p2cv-gwc5-w2gc","aliases":["CGA-p2cv-gwc5-w2gc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r1"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p2cv-gwc5-w2gc.json"},"ecosystem_specific":{"components":[{"component_name":"moment","component_purl":"pkg:npm/moment@2.30.1","component_type":"npm","component_version":"2.30.1","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:15:24Z"}]}}],"modified":"2026-10-02T05:17:36.480854848Z","provider":"osv","upstream":["CVE-2026-17495","GHSA-4p3w-j4w9-5jqw"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17495.json","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495"]},"related_cves":[{"value":"CVE-2026-17495","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:163c6a19-1342-443f-ae87-02fcbd2657d3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p2cv-gwc5-w2gc","advisory_id":"163c6a19-1342-443f-ae87-02fcbd2657d3","event_types":["advisory"],"published_at":"2026-10-25T21:02:23.671195+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:21:33+00:00","detail_url":"/events/66960"}]}},{"id":66145,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5578-4673-5r9x","summary":"CGA-5578-4673-5r9x","evidence":"osv:CGA-5578-4673-5r9x","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5578-4673-5r9x","aliases":["CGA-5578-4673-5r9x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r1"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5578-4673-5r9x.json"},"ecosystem_specific":{"components":[{"component_name":"moment","component_purl":"pkg:npm/moment@2.30.1","component_type":"npm","component_version":"2.30.1","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:01:41Z"}]}}],"modified":"2026-10-02T05:17:06.319753925Z","provider":"osv","references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17495.json","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:14345bc4-8539-447d-b5c2-999764b8effe","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5578-4673-5r9x","advisory_id":"14345bc4-8539-447d-b5c2-999764b8effe","event_types":["advisory"],"published_at":"2026-10-25T20:56:24.662776+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:19+00:00","detail_url":"/advisories/advisory%3A14345bc4-8539-447d-b5c2-999764b8effe","group":{"id":"advisory:14345bc4-8539-447d-b5c2-999764b8effe","revision":1,"primary_event_id":66515,"change":"published","superseded_by":[],"changed":{"id":66515,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5578-4673-5r9x","summary":"CGA-5578-4673-5r9x","evidence":"osv:CGA-5578-4673-5r9x","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5578-4673-5r9x","aliases":["CGA-5578-4673-5r9x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r1"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5578-4673-5r9x.json"},"ecosystem_specific":{"components":[{"component_name":"moment","component_purl":"pkg:npm/moment@2.30.1","component_type":"npm","component_version":"2.30.1","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:01:41Z"}]}}],"modified":"2026-10-02T05:17:06.319753925Z","provider":"osv","references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17495.json","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:14345bc4-8539-447d-b5c2-999764b8effe","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5578-4673-5r9x","advisory_id":"14345bc4-8539-447d-b5c2-999764b8effe","event_types":["advisory"],"published_at":"2026-10-25T20:56:24.662776+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:19+00:00","detail_url":"/events/66515"},"members":[{"id":66515,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5578-4673-5r9x","summary":"CGA-5578-4673-5r9x","evidence":"osv:CGA-5578-4673-5r9x","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12.1-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5578-4673-5r9x","aliases":["CGA-5578-4673-5r9x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12.1-r1"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/chainguard/arangodb-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5578-4673-5r9x.json"},"ecosystem_specific":{"components":[{"component_name":"moment","component_purl":"pkg:npm/moment@2.30.1","component_type":"npm","component_version":"2.30.1","component_location":"/usr/share/arangodb3/js/apps/system/_admin/aardvark/APP/react/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:01:41Z"}]}}],"modified":"2026-10-02T05:17:06.319753925Z","provider":"osv","references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17495.json","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:14345bc4-8539-447d-b5c2-999764b8effe","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5578-4673-5r9x","advisory_id":"14345bc4-8539-447d-b5c2-999764b8effe","event_types":["advisory"],"published_at":"2026-10-25T20:56:24.662776+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:28:19+00:00","detail_url":"/events/66515"}]}},{"id":31187,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-9w83-42gx-7v6c","summary":"MINI-9w83-42gx-7v6c","evidence":"osv:MINI-9w83-42gx-7v6c","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-9w83-42gx-7v6c","aliases":["MINI-9w83-42gx-7v6c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12-r0"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/minimos/arangodb-3.12","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-9w83-42gx-7v6c.json"}}],"modified":"2026-09-29T18:23:24.820289613Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e15eb3c8-0530-467c-89b1-a874f6ddefec","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-9w83-42gx-7v6c","advisory_id":"e15eb3c8-0530-467c-89b1-a874f6ddefec","event_types":["advisory"],"published_at":"2026-10-25T08:24:31.369458+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:21+00:00","detail_url":"/advisories/advisory%3Ae15eb3c8-0530-467c-89b1-a874f6ddefec","group":{"id":"advisory:e15eb3c8-0530-467c-89b1-a874f6ddefec","revision":1,"primary_event_id":30933,"change":"published","superseded_by":[],"changed":{"id":30933,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-9w83-42gx-7v6c","summary":"MINI-9w83-42gx-7v6c","evidence":"osv:MINI-9w83-42gx-7v6c","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-9w83-42gx-7v6c","aliases":["MINI-9w83-42gx-7v6c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12-r0"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/minimos/arangodb-3.12","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-9w83-42gx-7v6c.json"}}],"modified":"2026-09-29T18:23:24.820289613Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e15eb3c8-0530-467c-89b1-a874f6ddefec","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-9w83-42gx-7v6c","advisory_id":"e15eb3c8-0530-467c-89b1-a874f6ddefec","event_types":["advisory"],"published_at":"2026-10-25T08:24:31.369458+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:21+00:00","detail_url":"/events/30933"},"members":[{"id":30933,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-9w83-42gx-7v6c","summary":"MINI-9w83-42gx-7v6c","evidence":"osv:MINI-9w83-42gx-7v6c","products":[{"name":{"value":"arangodb-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.12-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-9w83-42gx-7v6c","aliases":["MINI-9w83-42gx-7v6c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.12-r0"}]}],"package":{"name":"arangodb-3.12","purl":"pkg:apk/minimos/arangodb-3.12","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-9w83-42gx-7v6c.json"}}],"modified":"2026-09-29T18:23:24.820289613Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e15eb3c8-0530-467c-89b1-a874f6ddefec","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-9w83-42gx-7v6c","advisory_id":"e15eb3c8-0530-467c-89b1-a874f6ddefec","event_types":["advisory"],"published_at":"2026-10-25T08:24:31.369458+00:00","technologies":["arangodb-3-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:21+00:00","detail_url":"/events/30933"}]}}],"next_after":76679,"next_before":31187}