{"schema_version":"2","view":"grouped","data":[{"id":72042,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-x96w-6fxw-x2f3","summary":"CGA-x96w-6fxw-x2f3","evidence":"osv:CGA-x96w-6fxw-x2f3","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x96w-6fxw-x2f3","aliases":["CGA-x96w-6fxw-x2f3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x96w-6fxw-x2f3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:45:07Z"}]}}],"modified":"2026-10-02T23:01:54.750583421Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a806d791-7cd6-412d-ad2d-1c8016183ed4","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x96w-6fxw-x2f3","advisory_id":"a806d791-7cd6-412d-ad2d-1c8016183ed4","event_types":["advisory"],"published_at":"2026-10-26T00:12:49.873093+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:31:41+00:00","detail_url":"/advisories/advisory%3Aa806d791-7cd6-412d-ad2d-1c8016183ed4","group":{"id":"advisory:a806d791-7cd6-412d-ad2d-1c8016183ed4","revision":1,"primary_event_id":72665,"change":"published","superseded_by":[],"changed":{"id":72665,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-x96w-6fxw-x2f3","summary":"CGA-x96w-6fxw-x2f3","evidence":"osv:CGA-x96w-6fxw-x2f3","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x96w-6fxw-x2f3","aliases":["CGA-x96w-6fxw-x2f3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x96w-6fxw-x2f3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:45:07Z"}]}}],"modified":"2026-10-02T23:01:54.750583421Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a806d791-7cd6-412d-ad2d-1c8016183ed4","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x96w-6fxw-x2f3","advisory_id":"a806d791-7cd6-412d-ad2d-1c8016183ed4","event_types":["advisory"],"published_at":"2026-10-26T00:12:49.873093+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:31:41+00:00","detail_url":"/events/72665"},"members":[{"id":72665,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-x96w-6fxw-x2f3","summary":"CGA-x96w-6fxw-x2f3","evidence":"osv:CGA-x96w-6fxw-x2f3","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x96w-6fxw-x2f3","aliases":["CGA-x96w-6fxw-x2f3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x96w-6fxw-x2f3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:45:07Z"}]}}],"modified":"2026-10-02T23:01:54.750583421Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a806d791-7cd6-412d-ad2d-1c8016183ed4","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x96w-6fxw-x2f3","advisory_id":"a806d791-7cd6-412d-ad2d-1c8016183ed4","event_types":["advisory"],"published_at":"2026-10-26T00:12:49.873093+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:31:41+00:00","detail_url":"/events/72665"}]}},{"id":71920,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-mh85-4ppf-m6hc","summary":"CGA-mh85-4ppf-m6hc","evidence":"osv:CGA-mh85-4ppf-m6hc","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mh85-4ppf-m6hc","aliases":["CGA-mh85-4ppf-m6hc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mh85-4ppf-m6hc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:27:59Z"}]}}],"modified":"2026-10-02T23:01:40.339271710Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9ab46786-80f5-41d7-95bd-f3d61bbea707","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mh85-4ppf-m6hc","advisory_id":"9ab46786-80f5-41d7-95bd-f3d61bbea707","event_types":["advisory"],"published_at":"2026-10-25T23:55:18.290955+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:22:04+00:00","detail_url":"/advisories/advisory%3A9ab46786-80f5-41d7-95bd-f3d61bbea707","group":{"id":"advisory:9ab46786-80f5-41d7-95bd-f3d61bbea707","revision":1,"primary_event_id":72453,"change":"published","superseded_by":[],"changed":{"id":72453,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-mh85-4ppf-m6hc","summary":"CGA-mh85-4ppf-m6hc","evidence":"osv:CGA-mh85-4ppf-m6hc","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mh85-4ppf-m6hc","aliases":["CGA-mh85-4ppf-m6hc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mh85-4ppf-m6hc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:27:59Z"}]}}],"modified":"2026-10-02T23:01:40.339271710Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9ab46786-80f5-41d7-95bd-f3d61bbea707","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mh85-4ppf-m6hc","advisory_id":"9ab46786-80f5-41d7-95bd-f3d61bbea707","event_types":["advisory"],"published_at":"2026-10-25T23:55:18.290955+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:22:04+00:00","detail_url":"/events/72453"},"members":[{"id":72453,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-mh85-4ppf-m6hc","summary":"CGA-mh85-4ppf-m6hc","evidence":"osv:CGA-mh85-4ppf-m6hc","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mh85-4ppf-m6hc","aliases":["CGA-mh85-4ppf-m6hc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mh85-4ppf-m6hc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:27:59Z"}]}}],"modified":"2026-10-02T23:01:40.339271710Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9ab46786-80f5-41d7-95bd-f3d61bbea707","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mh85-4ppf-m6hc","advisory_id":"9ab46786-80f5-41d7-95bd-f3d61bbea707","event_types":["advisory"],"published_at":"2026-10-25T23:55:18.290955+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:22:04+00:00","detail_url":"/events/72453"}]}},{"id":71640,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-rmwx-fxjh-587c","summary":"CGA-rmwx-fxjh-587c","evidence":"osv:CGA-rmwx-fxjh-587c","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rmwx-fxjh-587c","aliases":["CGA-rmwx-fxjh-587c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rmwx-fxjh-587c.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:45:06Z"}]}}],"modified":"2026-10-02T23:01:13.232904593Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:316d94ec-026d-4063-bcb9-9abfe2e15dc7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rmwx-fxjh-587c","advisory_id":"316d94ec-026d-4063-bcb9-9abfe2e15dc7","event_types":["advisory"],"published_at":"2026-10-25T23:25:09.103724+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:31:40+00:00","detail_url":"/advisories/advisory%3A316d94ec-026d-4063-bcb9-9abfe2e15dc7","group":{"id":"advisory:316d94ec-026d-4063-bcb9-9abfe2e15dc7","revision":1,"primary_event_id":72071,"change":"published","superseded_by":[],"changed":{"id":72071,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-rmwx-fxjh-587c","summary":"CGA-rmwx-fxjh-587c","evidence":"osv:CGA-rmwx-fxjh-587c","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rmwx-fxjh-587c","aliases":["CGA-rmwx-fxjh-587c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rmwx-fxjh-587c.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:45:06Z"}]}}],"modified":"2026-10-02T23:01:13.232904593Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:316d94ec-026d-4063-bcb9-9abfe2e15dc7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rmwx-fxjh-587c","advisory_id":"316d94ec-026d-4063-bcb9-9abfe2e15dc7","event_types":["advisory"],"published_at":"2026-10-25T23:25:09.103724+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:31:40+00:00","detail_url":"/events/72071"},"members":[{"id":72071,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-rmwx-fxjh-587c","summary":"CGA-rmwx-fxjh-587c","evidence":"osv:CGA-rmwx-fxjh-587c","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rmwx-fxjh-587c","aliases":["CGA-rmwx-fxjh-587c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rmwx-fxjh-587c.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:45:06Z"}]}}],"modified":"2026-10-02T23:01:13.232904593Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:316d94ec-026d-4063-bcb9-9abfe2e15dc7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rmwx-fxjh-587c","advisory_id":"316d94ec-026d-4063-bcb9-9abfe2e15dc7","event_types":["advisory"],"published_at":"2026-10-25T23:25:09.103724+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:31:40+00:00","detail_url":"/events/72071"}]}},{"id":71056,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-m6p3-wx89-qrv5","summary":"CGA-m6p3-wx89-qrv5","evidence":"osv:CGA-m6p3-wx89-qrv5","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m6p3-wx89-qrv5","aliases":["CGA-m6p3-wx89-qrv5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6p3-wx89-qrv5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:28:00Z"}]}}],"modified":"2026-10-02T23:00:10.786481301Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6p3-wx89-qrv5","advisory_id":"7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","event_types":["advisory"],"published_at":"2026-10-25T22:48:53.940024+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:22:05+00:00","detail_url":"/advisories/advisory%3A7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","group":{"id":"advisory:7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","revision":1,"primary_event_id":71430,"change":"published","superseded_by":[],"changed":{"id":71430,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-m6p3-wx89-qrv5","summary":"CGA-m6p3-wx89-qrv5","evidence":"osv:CGA-m6p3-wx89-qrv5","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m6p3-wx89-qrv5","aliases":["CGA-m6p3-wx89-qrv5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6p3-wx89-qrv5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:28:00Z"}]}}],"modified":"2026-10-02T23:00:10.786481301Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6p3-wx89-qrv5","advisory_id":"7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","event_types":["advisory"],"published_at":"2026-10-25T22:48:53.940024+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:22:05+00:00","detail_url":"/events/71430"},"members":[{"id":71430,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-m6p3-wx89-qrv5","summary":"CGA-m6p3-wx89-qrv5","evidence":"osv:CGA-m6p3-wx89-qrv5","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m6p3-wx89-qrv5","aliases":["CGA-m6p3-wx89-qrv5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r3"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m6p3-wx89-qrv5.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-core-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:28:00Z"}]}}],"modified":"2026-10-02T23:00:10.786481301Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m6p3-wx89-qrv5","advisory_id":"7ab7be0f-9c3b-4dc0-bdff-003cd3564ede","event_types":["advisory"],"published_at":"2026-10-25T22:48:53.940024+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T13:22:05+00:00","detail_url":"/events/71430"}]}},{"id":69948,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"MINI-pggf-jc44-56wf","summary":"MINI-pggf-jc44-56wf","evidence":"osv:MINI-pggf-jc44-56wf","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-pggf-jc44-56wf","aliases":["MINI-pggf-jc44-56wf"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-pggf-jc44-56wf.json"}}],"modified":"2026-10-02T18:23:28.250435893Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b6bba51e-234c-4236-9e34-515bb8486b9c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-pggf-jc44-56wf","advisory_id":"b6bba51e-234c-4236-9e34-515bb8486b9c","event_types":["advisory"],"published_at":"2026-10-25T22:10:49.072581+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:26:51+00:00","detail_url":"/advisories/advisory%3Ab6bba51e-234c-4236-9e34-515bb8486b9c","group":{"id":"advisory:b6bba51e-234c-4236-9e34-515bb8486b9c","revision":1,"primary_event_id":70318,"change":"published","superseded_by":[],"changed":{"id":70318,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"MINI-pggf-jc44-56wf","summary":"MINI-pggf-jc44-56wf","evidence":"osv:MINI-pggf-jc44-56wf","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-pggf-jc44-56wf","aliases":["MINI-pggf-jc44-56wf"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-pggf-jc44-56wf.json"}}],"modified":"2026-10-02T18:23:28.250435893Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b6bba51e-234c-4236-9e34-515bb8486b9c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-pggf-jc44-56wf","advisory_id":"b6bba51e-234c-4236-9e34-515bb8486b9c","event_types":["advisory"],"published_at":"2026-10-25T22:10:49.072581+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:26:51+00:00","detail_url":"/events/70318"},"members":[{"id":70318,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"MINI-pggf-jc44-56wf","summary":"MINI-pggf-jc44-56wf","evidence":"osv:MINI-pggf-jc44-56wf","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-pggf-jc44-56wf","aliases":["MINI-pggf-jc44-56wf"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-pggf-jc44-56wf.json"}}],"modified":"2026-10-02T18:23:28.250435893Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b6bba51e-234c-4236-9e34-515bb8486b9c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-pggf-jc44-56wf","advisory_id":"b6bba51e-234c-4236-9e34-515bb8486b9c","event_types":["advisory"],"published_at":"2026-10-25T22:10:49.072581+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:26:51+00:00","detail_url":"/events/70318"}]}},{"id":69912,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"MINI-6g4v-fr3m-4q75","summary":"MINI-6g4v-fr3m-4q75","evidence":"osv:MINI-6g4v-fr3m-4q75","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-6g4v-fr3m-4q75","aliases":["MINI-6g4v-fr3m-4q75"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-6g4v-fr3m-4q75.json"}}],"modified":"2026-10-02T18:23:25.629005142Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6590b1fc-71b0-466f-b64d-df6145075ef2","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-6g4v-fr3m-4q75","advisory_id":"6590b1fc-71b0-466f-b64d-df6145075ef2","event_types":["advisory"],"published_at":"2026-10-25T22:10:11.50485+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:26:51+00:00","detail_url":"/advisories/advisory%3A6590b1fc-71b0-466f-b64d-df6145075ef2","group":{"id":"advisory:6590b1fc-71b0-466f-b64d-df6145075ef2","revision":1,"primary_event_id":70282,"change":"published","superseded_by":[],"changed":{"id":70282,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"MINI-6g4v-fr3m-4q75","summary":"MINI-6g4v-fr3m-4q75","evidence":"osv:MINI-6g4v-fr3m-4q75","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-6g4v-fr3m-4q75","aliases":["MINI-6g4v-fr3m-4q75"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-6g4v-fr3m-4q75.json"}}],"modified":"2026-10-02T18:23:25.629005142Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6590b1fc-71b0-466f-b64d-df6145075ef2","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-6g4v-fr3m-4q75","advisory_id":"6590b1fc-71b0-466f-b64d-df6145075ef2","event_types":["advisory"],"published_at":"2026-10-25T22:10:11.50485+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:26:51+00:00","detail_url":"/events/70282"},"members":[{"id":70282,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"MINI-6g4v-fr3m-4q75","summary":"MINI-6g4v-fr3m-4q75","evidence":"osv:MINI-6g4v-fr3m-4q75","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-6g4v-fr3m-4q75","aliases":["MINI-6g4v-fr3m-4q75"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-6g4v-fr3m-4q75.json"}}],"modified":"2026-10-02T18:23:25.629005142Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6590b1fc-71b0-466f-b64d-df6145075ef2","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-6g4v-fr3m-4q75","advisory_id":"6590b1fc-71b0-466f-b64d-df6145075ef2","event_types":["advisory"],"published_at":"2026-10-25T22:10:11.50485+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:26:51+00:00","detail_url":"/events/70282"}]}},{"id":64904,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-g7wm-hrhm-pmf4","summary":"CGA-g7wm-hrhm-pmf4","evidence":"osv:CGA-g7wm-hrhm-pmf4","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g7wm-hrhm-pmf4","aliases":["CGA-g7wm-hrhm-pmf4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g7wm-hrhm-pmf4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T22:43:15Z"}]}}],"modified":"2026-10-02T05:16:43.343454177Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c84ad2c5-cdf4-45ac-832e-fc816d03df84","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g7wm-hrhm-pmf4","advisory_id":"c84ad2c5-cdf4-45ac-832e-fc816d03df84","event_types":["advisory"],"published_at":"2026-10-25T20:53:17.069312+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:11:37+00:00","detail_url":"/advisories/advisory%3Ac84ad2c5-cdf4-45ac-832e-fc816d03df84","group":{"id":"advisory:c84ad2c5-cdf4-45ac-832e-fc816d03df84","revision":1,"primary_event_id":66283,"change":"published","superseded_by":[],"changed":{"id":66283,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-g7wm-hrhm-pmf4","summary":"CGA-g7wm-hrhm-pmf4","evidence":"osv:CGA-g7wm-hrhm-pmf4","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g7wm-hrhm-pmf4","aliases":["CGA-g7wm-hrhm-pmf4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g7wm-hrhm-pmf4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T22:43:15Z"}]}}],"modified":"2026-10-02T05:16:43.343454177Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c84ad2c5-cdf4-45ac-832e-fc816d03df84","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g7wm-hrhm-pmf4","advisory_id":"c84ad2c5-cdf4-45ac-832e-fc816d03df84","event_types":["advisory"],"published_at":"2026-10-25T20:53:17.069312+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:11:37+00:00","detail_url":"/events/66283"},"members":[{"id":66283,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-g7wm-hrhm-pmf4","summary":"CGA-g7wm-hrhm-pmf4","evidence":"osv:CGA-g7wm-hrhm-pmf4","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g7wm-hrhm-pmf4","aliases":["CGA-g7wm-hrhm-pmf4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g7wm-hrhm-pmf4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T22:43:15Z"}]}}],"modified":"2026-10-02T05:16:43.343454177Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c84ad2c5-cdf4-45ac-832e-fc816d03df84","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g7wm-hrhm-pmf4","advisory_id":"c84ad2c5-cdf4-45ac-832e-fc816d03df84","event_types":["advisory"],"published_at":"2026-10-25T20:53:17.069312+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:11:37+00:00","detail_url":"/events/66283"}]}},{"id":64294,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m4x3-pjf6-3gm6","summary":"CGA-m4x3-pjf6-3gm6","evidence":"osv:CGA-m4x3-pjf6-3gm6","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m4x3-pjf6-3gm6","aliases":["CGA-m4x3-pjf6-3gm6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m4x3-pjf6-3gm6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:23:08Z"}]}}],"modified":"2026-10-01T18:25:32.866621233Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2c76e54f-5056-405b-82b4-ad3a76888691","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m4x3-pjf6-3gm6","advisory_id":"2c76e54f-5056-405b-82b4-ad3a76888691","event_types":["advisory"],"published_at":"2026-10-25T19:46:33.087094+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:02:10+00:00","detail_url":"/advisories/advisory%3A2c76e54f-5056-405b-82b4-ad3a76888691","group":{"id":"advisory:2c76e54f-5056-405b-82b4-ad3a76888691","revision":1,"primary_event_id":63560,"change":"published","superseded_by":[],"changed":{"id":63560,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m4x3-pjf6-3gm6","summary":"CGA-m4x3-pjf6-3gm6","evidence":"osv:CGA-m4x3-pjf6-3gm6","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m4x3-pjf6-3gm6","aliases":["CGA-m4x3-pjf6-3gm6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m4x3-pjf6-3gm6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:23:08Z"}]}}],"modified":"2026-10-01T18:25:32.866621233Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2c76e54f-5056-405b-82b4-ad3a76888691","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m4x3-pjf6-3gm6","advisory_id":"2c76e54f-5056-405b-82b4-ad3a76888691","event_types":["advisory"],"published_at":"2026-10-25T19:46:33.087094+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:02:10+00:00","detail_url":"/events/63560"},"members":[{"id":63560,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m4x3-pjf6-3gm6","summary":"CGA-m4x3-pjf6-3gm6","evidence":"osv:CGA-m4x3-pjf6-3gm6","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m4x3-pjf6-3gm6","aliases":["CGA-m4x3-pjf6-3gm6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m4x3-pjf6-3gm6.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:23:08Z"}]}}],"modified":"2026-10-01T18:25:32.866621233Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2c76e54f-5056-405b-82b4-ad3a76888691","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m4x3-pjf6-3gm6","advisory_id":"2c76e54f-5056-405b-82b4-ad3a76888691","event_types":["advisory"],"published_at":"2026-10-25T19:46:33.087094+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:02:10+00:00","detail_url":"/events/63560"}]}},{"id":64076,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7rxr-mjgf-7r9x","summary":"CGA-7rxr-mjgf-7r9x","evidence":"osv:CGA-7rxr-mjgf-7r9x","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7rxr-mjgf-7r9x","aliases":["CGA-7rxr-mjgf-7r9x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7rxr-mjgf-7r9x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:23:08Z"}]}}],"modified":"2026-10-01T18:25:29.965422059Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5e80228d-f726-439c-8466-fd183f8353af","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7rxr-mjgf-7r9x","advisory_id":"5e80228d-f726-439c-8466-fd183f8353af","event_types":["advisory"],"published_at":"2026-10-25T19:42:57.904003+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:02:10+00:00","detail_url":"/advisories/advisory%3A5e80228d-f726-439c-8466-fd183f8353af","group":{"id":"advisory:5e80228d-f726-439c-8466-fd183f8353af","revision":1,"primary_event_id":63345,"change":"published","superseded_by":[],"changed":{"id":63345,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7rxr-mjgf-7r9x","summary":"CGA-7rxr-mjgf-7r9x","evidence":"osv:CGA-7rxr-mjgf-7r9x","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7rxr-mjgf-7r9x","aliases":["CGA-7rxr-mjgf-7r9x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7rxr-mjgf-7r9x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:23:08Z"}]}}],"modified":"2026-10-01T18:25:29.965422059Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5e80228d-f726-439c-8466-fd183f8353af","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7rxr-mjgf-7r9x","advisory_id":"5e80228d-f726-439c-8466-fd183f8353af","event_types":["advisory"],"published_at":"2026-10-25T19:42:57.904003+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:02:10+00:00","detail_url":"/events/63345"},"members":[{"id":63345,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7rxr-mjgf-7r9x","summary":"CGA-7rxr-mjgf-7r9x","evidence":"osv:CGA-7rxr-mjgf-7r9x","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7rxr-mjgf-7r9x","aliases":["CGA-7rxr-mjgf-7r9x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7rxr-mjgf-7r9x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:23:08Z"}]}}],"modified":"2026-10-01T18:25:29.965422059Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5e80228d-f726-439c-8466-fd183f8353af","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7rxr-mjgf-7r9x","advisory_id":"5e80228d-f726-439c-8466-fd183f8353af","event_types":["advisory"],"published_at":"2026-10-25T19:42:57.904003+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:02:10+00:00","detail_url":"/events/63345"}]}},{"id":64043,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-67r6-9jq4-5f46","summary":"CGA-67r6-9jq4-5f46","evidence":"osv:CGA-67r6-9jq4-5f46","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-67r6-9jq4-5f46","aliases":["CGA-67r6-9jq4-5f46"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67r6-9jq4-5f46.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:31:17Z"}]}}],"modified":"2026-10-01T18:25:29.406727673Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ddf4003f-5904-49ea-9790-07787468bd1f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67r6-9jq4-5f46","advisory_id":"ddf4003f-5904-49ea-9790-07787468bd1f","event_types":["advisory"],"published_at":"2026-10-25T19:42:31.718333+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:55:26+00:00","detail_url":"/advisories/advisory%3Addf4003f-5904-49ea-9790-07787468bd1f","group":{"id":"advisory:ddf4003f-5904-49ea-9790-07787468bd1f","revision":1,"primary_event_id":63312,"change":"published","superseded_by":[],"changed":{"id":63312,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-67r6-9jq4-5f46","summary":"CGA-67r6-9jq4-5f46","evidence":"osv:CGA-67r6-9jq4-5f46","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-67r6-9jq4-5f46","aliases":["CGA-67r6-9jq4-5f46"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67r6-9jq4-5f46.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:31:17Z"}]}}],"modified":"2026-10-01T18:25:29.406727673Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ddf4003f-5904-49ea-9790-07787468bd1f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67r6-9jq4-5f46","advisory_id":"ddf4003f-5904-49ea-9790-07787468bd1f","event_types":["advisory"],"published_at":"2026-10-25T19:42:31.718333+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:55:26+00:00","detail_url":"/events/63312"},"members":[{"id":63312,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-67r6-9jq4-5f46","summary":"CGA-67r6-9jq4-5f46","evidence":"osv:CGA-67r6-9jq4-5f46","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-67r6-9jq4-5f46","aliases":["CGA-67r6-9jq4-5f46"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67r6-9jq4-5f46.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:31:17Z"}]}}],"modified":"2026-10-01T18:25:29.406727673Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ddf4003f-5904-49ea-9790-07787468bd1f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67r6-9jq4-5f46","advisory_id":"ddf4003f-5904-49ea-9790-07787468bd1f","event_types":["advisory"],"published_at":"2026-10-25T19:42:31.718333+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:55:26+00:00","detail_url":"/events/63312"}]}},{"id":63920,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2gvj-4vh6-wmjq","summary":"CGA-2gvj-4vh6-wmjq","evidence":"osv:CGA-2gvj-4vh6-wmjq","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2gvj-4vh6-wmjq","aliases":["CGA-2gvj-4vh6-wmjq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2gvj-4vh6-wmjq.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T14:34:59Z"}]}}],"modified":"2026-10-01T18:25:27.825863293Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453","https://github.com/elasticsearch","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37727.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37727"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:689abc16-5889-413d-8f0f-3af5400e0f3e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2gvj-4vh6-wmjq","advisory_id":"689abc16-5889-413d-8f0f-3af5400e0f3e","event_types":["advisory"],"published_at":"2026-10-25T19:39:55.239851+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/advisories/advisory%3A689abc16-5889-413d-8f0f-3af5400e0f3e","group":{"id":"advisory:689abc16-5889-413d-8f0f-3af5400e0f3e","revision":1,"primary_event_id":63193,"change":"published","superseded_by":[],"changed":{"id":63193,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2gvj-4vh6-wmjq","summary":"CGA-2gvj-4vh6-wmjq","evidence":"osv:CGA-2gvj-4vh6-wmjq","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2gvj-4vh6-wmjq","aliases":["CGA-2gvj-4vh6-wmjq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2gvj-4vh6-wmjq.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T14:34:59Z"}]}}],"modified":"2026-10-01T18:25:27.825863293Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453","https://github.com/elasticsearch","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37727.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37727"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:689abc16-5889-413d-8f0f-3af5400e0f3e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2gvj-4vh6-wmjq","advisory_id":"689abc16-5889-413d-8f0f-3af5400e0f3e","event_types":["advisory"],"published_at":"2026-10-25T19:39:55.239851+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/63193"},"members":[{"id":63193,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2gvj-4vh6-wmjq","summary":"CGA-2gvj-4vh6-wmjq","evidence":"osv:CGA-2gvj-4vh6-wmjq","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2gvj-4vh6-wmjq","aliases":["CGA-2gvj-4vh6-wmjq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2gvj-4vh6-wmjq.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T14:34:59Z"}]}}],"modified":"2026-10-01T18:25:27.825863293Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453","https://github.com/elasticsearch","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37727.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37727"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:689abc16-5889-413d-8f0f-3af5400e0f3e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2gvj-4vh6-wmjq","advisory_id":"689abc16-5889-413d-8f0f-3af5400e0f3e","event_types":["advisory"],"published_at":"2026-10-25T19:39:55.239851+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/63193"}]}},{"id":63888,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-x896-345x-7mqr","summary":"MINI-x896-345x-7mqr","evidence":"osv:MINI-x896-345x-7mqr","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-x896-345x-7mqr","aliases":["MINI-x896-345x-7mqr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-x896-345x-7mqr.json"}}],"modified":"2026-10-01T18:24:11.168806544Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:09f59e68-bcc6-4879-9815-f71e467e1f4a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-x896-345x-7mqr","advisory_id":"09f59e68-bcc6-4879-9815-f71e467e1f4a","event_types":["advisory"],"published_at":"2026-10-25T19:39:30.443305+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:10:56+00:00","detail_url":"/advisories/advisory%3A09f59e68-bcc6-4879-9815-f71e467e1f4a","group":{"id":"advisory:09f59e68-bcc6-4879-9815-f71e467e1f4a","revision":1,"primary_event_id":63161,"change":"published","superseded_by":[],"changed":{"id":63161,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-x896-345x-7mqr","summary":"MINI-x896-345x-7mqr","evidence":"osv:MINI-x896-345x-7mqr","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-x896-345x-7mqr","aliases":["MINI-x896-345x-7mqr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-x896-345x-7mqr.json"}}],"modified":"2026-10-01T18:24:11.168806544Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:09f59e68-bcc6-4879-9815-f71e467e1f4a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-x896-345x-7mqr","advisory_id":"09f59e68-bcc6-4879-9815-f71e467e1f4a","event_types":["advisory"],"published_at":"2026-10-25T19:39:30.443305+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:10:56+00:00","detail_url":"/events/63161"},"members":[{"id":63161,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-x896-345x-7mqr","summary":"MINI-x896-345x-7mqr","evidence":"osv:MINI-x896-345x-7mqr","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-x896-345x-7mqr","aliases":["MINI-x896-345x-7mqr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-x896-345x-7mqr.json"}}],"modified":"2026-10-01T18:24:11.168806544Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:09f59e68-bcc6-4879-9815-f71e467e1f4a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-x896-345x-7mqr","advisory_id":"09f59e68-bcc6-4879-9815-f71e467e1f4a","event_types":["advisory"],"published_at":"2026-10-25T19:39:30.443305+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:10:56+00:00","detail_url":"/events/63161"}]}},{"id":63827,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-9rcj-xxvh-7jhc","summary":"CGA-9rcj-xxvh-7jhc","evidence":"osv:CGA-9rcj-xxvh-7jhc","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9rcj-xxvh-7jhc","aliases":["CGA-9rcj-xxvh-7jhc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rcj-xxvh-7jhc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T22:43:14Z"}]}}],"modified":"2026-10-02T05:16:41.709130658Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:af91df5e-258b-48b0-9eea-09656d38eda2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9rcj-xxvh-7jhc","advisory_id":"af91df5e-258b-48b0-9eea-09656d38eda2","event_types":["advisory"],"published_at":"2026-10-25T20:52:53.494231+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:11:37+00:00","detail_url":"/advisories/advisory%3Aaf91df5e-258b-48b0-9eea-09656d38eda2","group":{"id":"advisory:af91df5e-258b-48b0-9eea-09656d38eda2","revision":1,"primary_event_id":66262,"change":"published","superseded_by":[],"changed":{"id":66262,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-9rcj-xxvh-7jhc","summary":"CGA-9rcj-xxvh-7jhc","evidence":"osv:CGA-9rcj-xxvh-7jhc","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9rcj-xxvh-7jhc","aliases":["CGA-9rcj-xxvh-7jhc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rcj-xxvh-7jhc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T22:43:14Z"}]}}],"modified":"2026-10-02T05:16:41.709130658Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:af91df5e-258b-48b0-9eea-09656d38eda2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9rcj-xxvh-7jhc","advisory_id":"af91df5e-258b-48b0-9eea-09656d38eda2","event_types":["advisory"],"published_at":"2026-10-25T20:52:53.494231+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:11:37+00:00","detail_url":"/events/66262"},"members":[{"id":66262,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-9rcj-xxvh-7jhc","summary":"CGA-9rcj-xxvh-7jhc","evidence":"osv:CGA-9rcj-xxvh-7jhc","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9rcj-xxvh-7jhc","aliases":["CGA-9rcj-xxvh-7jhc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rcj-xxvh-7jhc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T22:43:14Z"}]}}],"modified":"2026-10-02T05:16:41.709130658Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:af91df5e-258b-48b0-9eea-09656d38eda2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9rcj-xxvh-7jhc","advisory_id":"af91df5e-258b-48b0-9eea-09656d38eda2","event_types":["advisory"],"published_at":"2026-10-25T20:52:53.494231+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:11:37+00:00","detail_url":"/events/66262"}]}},{"id":63466,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-f947-5hr5-crgg","summary":"MINI-f947-5hr5-crgg","evidence":"osv:MINI-f947-5hr5-crgg","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-f947-5hr5-crgg","aliases":["MINI-f947-5hr5-crgg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-f947-5hr5-crgg.json"}}],"modified":"2026-10-01T18:23:34.824591422Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3ce2afbd-cb08-4e22-97d3-958573c209fb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-f947-5hr5-crgg","advisory_id":"3ce2afbd-cb08-4e22-97d3-958573c209fb","event_types":["advisory"],"published_at":"2026-10-25T19:33:19.440389+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:10:56+00:00","detail_url":"/advisories/advisory%3A3ce2afbd-cb08-4e22-97d3-958573c209fb","group":{"id":"advisory:3ce2afbd-cb08-4e22-97d3-958573c209fb","revision":1,"primary_event_id":62747,"change":"published","superseded_by":[],"changed":{"id":62747,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-f947-5hr5-crgg","summary":"MINI-f947-5hr5-crgg","evidence":"osv:MINI-f947-5hr5-crgg","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-f947-5hr5-crgg","aliases":["MINI-f947-5hr5-crgg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-f947-5hr5-crgg.json"}}],"modified":"2026-10-01T18:23:34.824591422Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3ce2afbd-cb08-4e22-97d3-958573c209fb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-f947-5hr5-crgg","advisory_id":"3ce2afbd-cb08-4e22-97d3-958573c209fb","event_types":["advisory"],"published_at":"2026-10-25T19:33:19.440389+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:10:56+00:00","detail_url":"/events/62747"},"members":[{"id":62747,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-f947-5hr5-crgg","summary":"MINI-f947-5hr5-crgg","evidence":"osv:MINI-f947-5hr5-crgg","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-f947-5hr5-crgg","aliases":["MINI-f947-5hr5-crgg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-f947-5hr5-crgg.json"}}],"modified":"2026-10-01T18:23:34.824591422Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3ce2afbd-cb08-4e22-97d3-958573c209fb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-f947-5hr5-crgg","advisory_id":"3ce2afbd-cb08-4e22-97d3-958573c209fb","event_types":["advisory"],"published_at":"2026-10-25T19:33:19.440389+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:10:56+00:00","detail_url":"/events/62747"}]}},{"id":59893,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xp72-vc5p-7m87","summary":"CGA-xp72-vc5p-7m87","evidence":"osv:CGA-xp72-vc5p-7m87","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xp72-vc5p-7m87","aliases":["CGA-xp72-vc5p-7m87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xp72-vc5p-7m87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:00:15Z"}]}}],"modified":"2026-10-02T05:16:33.962218178Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f7132003-fe21-4dec-a0b6-5f486e89fe92","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xp72-vc5p-7m87","advisory_id":"f7132003-fe21-4dec-a0b6-5f486e89fe92","event_types":["advisory"],"published_at":"2026-10-25T20:51:25.341933+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:18:57+00:00","detail_url":"/advisories/advisory%3Af7132003-fe21-4dec-a0b6-5f486e89fe92","group":{"id":"advisory:f7132003-fe21-4dec-a0b6-5f486e89fe92","revision":1,"primary_event_id":66188,"change":"published","superseded_by":[],"changed":{"id":66188,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xp72-vc5p-7m87","summary":"CGA-xp72-vc5p-7m87","evidence":"osv:CGA-xp72-vc5p-7m87","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xp72-vc5p-7m87","aliases":["CGA-xp72-vc5p-7m87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xp72-vc5p-7m87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:00:15Z"}]}}],"modified":"2026-10-02T05:16:33.962218178Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f7132003-fe21-4dec-a0b6-5f486e89fe92","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xp72-vc5p-7m87","advisory_id":"f7132003-fe21-4dec-a0b6-5f486e89fe92","event_types":["advisory"],"published_at":"2026-10-25T20:51:25.341933+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:18:57+00:00","detail_url":"/events/66188"},"members":[{"id":66188,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xp72-vc5p-7m87","summary":"CGA-xp72-vc5p-7m87","evidence":"osv:CGA-xp72-vc5p-7m87","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xp72-vc5p-7m87","aliases":["CGA-xp72-vc5p-7m87"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xp72-vc5p-7m87.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:00:15Z"}]}}],"modified":"2026-10-02T05:16:33.962218178Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f7132003-fe21-4dec-a0b6-5f486e89fe92","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xp72-vc5p-7m87","advisory_id":"f7132003-fe21-4dec-a0b6-5f486e89fe92","event_types":["advisory"],"published_at":"2026-10-25T20:51:25.341933+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:18:57+00:00","detail_url":"/events/66188"}]}},{"id":51645,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-8rcq-qj6w-vmx3","summary":"CGA-8rcq-qj6w-vmx3","evidence":"osv:CGA-8rcq-qj6w-vmx3","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8rcq-qj6w-vmx3","aliases":["CGA-8rcq-qj6w-vmx3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8rcq-qj6w-vmx3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:23:08Z"}]}}],"modified":"2026-09-30T23:00:30.800687470Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:53eb5087-e10c-42cc-8f2c-c3cc9e08fc81","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8rcq-qj6w-vmx3","advisory_id":"53eb5087-e10c-42cc-8f2c-c3cc9e08fc81","event_types":["advisory"],"published_at":"2026-10-25T14:19:36.071569+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:02:10+00:00","detail_url":"/advisories/advisory%3A53eb5087-e10c-42cc-8f2c-c3cc9e08fc81","group":{"id":"advisory:53eb5087-e10c-42cc-8f2c-c3cc9e08fc81","revision":1,"primary_event_id":51173,"change":"published","superseded_by":[],"changed":{"id":51173,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-8rcq-qj6w-vmx3","summary":"CGA-8rcq-qj6w-vmx3","evidence":"osv:CGA-8rcq-qj6w-vmx3","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8rcq-qj6w-vmx3","aliases":["CGA-8rcq-qj6w-vmx3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8rcq-qj6w-vmx3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:23:08Z"}]}}],"modified":"2026-09-30T23:00:30.800687470Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:53eb5087-e10c-42cc-8f2c-c3cc9e08fc81","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8rcq-qj6w-vmx3","advisory_id":"53eb5087-e10c-42cc-8f2c-c3cc9e08fc81","event_types":["advisory"],"published_at":"2026-10-25T14:19:36.071569+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:02:10+00:00","detail_url":"/events/51173"},"members":[{"id":51173,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-8rcq-qj6w-vmx3","summary":"CGA-8rcq-qj6w-vmx3","evidence":"osv:CGA-8rcq-qj6w-vmx3","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8rcq-qj6w-vmx3","aliases":["CGA-8rcq-qj6w-vmx3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8rcq-qj6w-vmx3.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:23:08Z"}]}}],"modified":"2026-09-30T23:00:30.800687470Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:53eb5087-e10c-42cc-8f2c-c3cc9e08fc81","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8rcq-qj6w-vmx3","advisory_id":"53eb5087-e10c-42cc-8f2c-c3cc9e08fc81","event_types":["advisory"],"published_at":"2026-10-25T14:19:36.071569+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:02:10+00:00","detail_url":"/events/51173"}]}},{"id":51417,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2pgv-jpgh-6wj2","summary":"CGA-2pgv-jpgh-6wj2","evidence":"osv:CGA-2pgv-jpgh-6wj2","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2pgv-jpgh-6wj2","aliases":["CGA-2pgv-jpgh-6wj2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2pgv-jpgh-6wj2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:31:17Z"}]}}],"modified":"2026-09-30T23:00:07.147368926Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:021179c2-1b99-427e-bc69-4381146880f3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2pgv-jpgh-6wj2","advisory_id":"021179c2-1b99-427e-bc69-4381146880f3","event_types":["advisory"],"published_at":"2026-10-25T14:15:27.825791+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:55:26+00:00","detail_url":"/advisories/advisory%3A021179c2-1b99-427e-bc69-4381146880f3","group":{"id":"advisory:021179c2-1b99-427e-bc69-4381146880f3","revision":1,"primary_event_id":50945,"change":"published","superseded_by":[],"changed":{"id":50945,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2pgv-jpgh-6wj2","summary":"CGA-2pgv-jpgh-6wj2","evidence":"osv:CGA-2pgv-jpgh-6wj2","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2pgv-jpgh-6wj2","aliases":["CGA-2pgv-jpgh-6wj2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2pgv-jpgh-6wj2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:31:17Z"}]}}],"modified":"2026-09-30T23:00:07.147368926Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:021179c2-1b99-427e-bc69-4381146880f3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2pgv-jpgh-6wj2","advisory_id":"021179c2-1b99-427e-bc69-4381146880f3","event_types":["advisory"],"published_at":"2026-10-25T14:15:27.825791+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:55:26+00:00","detail_url":"/events/50945"},"members":[{"id":50945,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2pgv-jpgh-6wj2","summary":"CGA-2pgv-jpgh-6wj2","evidence":"osv:CGA-2pgv-jpgh-6wj2","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2pgv-jpgh-6wj2","aliases":["CGA-2pgv-jpgh-6wj2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2pgv-jpgh-6wj2.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:31:17Z"}]}}],"modified":"2026-09-30T23:00:07.147368926Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:021179c2-1b99-427e-bc69-4381146880f3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2pgv-jpgh-6wj2","advisory_id":"021179c2-1b99-427e-bc69-4381146880f3","event_types":["advisory"],"published_at":"2026-10-25T14:15:27.825791+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:55:26+00:00","detail_url":"/events/50945"}]}},{"id":51395,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-28h2-x2xv-99cp","summary":"CGA-28h2-x2xv-99cp","evidence":"osv:CGA-28h2-x2xv-99cp","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-28h2-x2xv-99cp","aliases":["CGA-28h2-x2xv-99cp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-28h2-x2xv-99cp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:31:18Z"}]}}],"modified":"2026-09-30T23:00:05.243517448Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c090c5cc-ffd5-4926-8fff-2d448b761fbc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-28h2-x2xv-99cp","advisory_id":"c090c5cc-ffd5-4926-8fff-2d448b761fbc","event_types":["advisory"],"published_at":"2026-10-25T14:15:07.17926+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:55:27+00:00","detail_url":"/advisories/advisory%3Ac090c5cc-ffd5-4926-8fff-2d448b761fbc","group":{"id":"advisory:c090c5cc-ffd5-4926-8fff-2d448b761fbc","revision":1,"primary_event_id":50923,"change":"published","superseded_by":[],"changed":{"id":50923,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-28h2-x2xv-99cp","summary":"CGA-28h2-x2xv-99cp","evidence":"osv:CGA-28h2-x2xv-99cp","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-28h2-x2xv-99cp","aliases":["CGA-28h2-x2xv-99cp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-28h2-x2xv-99cp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:31:18Z"}]}}],"modified":"2026-09-30T23:00:05.243517448Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c090c5cc-ffd5-4926-8fff-2d448b761fbc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-28h2-x2xv-99cp","advisory_id":"c090c5cc-ffd5-4926-8fff-2d448b761fbc","event_types":["advisory"],"published_at":"2026-10-25T14:15:07.17926+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:55:27+00:00","detail_url":"/events/50923"},"members":[{"id":50923,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-28h2-x2xv-99cp","summary":"CGA-28h2-x2xv-99cp","evidence":"osv:CGA-28h2-x2xv-99cp","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-28h2-x2xv-99cp","aliases":["CGA-28h2-x2xv-99cp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-28h2-x2xv-99cp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.5.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T20:31:18Z"}]}}],"modified":"2026-09-30T23:00:05.243517448Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c090c5cc-ffd5-4926-8fff-2d448b761fbc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-28h2-x2xv-99cp","advisory_id":"c090c5cc-ffd5-4926-8fff-2d448b761fbc","event_types":["advisory"],"published_at":"2026-10-25T14:15:07.17926+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:55:27+00:00","detail_url":"/events/50923"}]}},{"id":45670,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xqwp-8wgc-8hcg","summary":"CGA-xqwp-8wgc-8hcg","evidence":"osv:CGA-xqwp-8wgc-8hcg","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xqwp-8wgc-8hcg","aliases":["CGA-xqwp-8wgc-8hcg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqwp-8wgc-8hcg.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T12:14:14Z"}]}}],"modified":"2026-09-30T17:02:11.420774183Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453","https://github.com/elasticsearch","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37727.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37727"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:83906085-f63b-446f-84ac-02693add0a77","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqwp-8wgc-8hcg","advisory_id":"83906085-f63b-446f-84ac-02693add0a77","event_types":["advisory"],"published_at":"2026-10-25T12:30:25.501159+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/advisories/advisory%3A83906085-f63b-446f-84ac-02693add0a77","group":{"id":"advisory:83906085-f63b-446f-84ac-02693add0a77","revision":1,"primary_event_id":45232,"change":"published","superseded_by":[],"changed":{"id":45232,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xqwp-8wgc-8hcg","summary":"CGA-xqwp-8wgc-8hcg","evidence":"osv:CGA-xqwp-8wgc-8hcg","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xqwp-8wgc-8hcg","aliases":["CGA-xqwp-8wgc-8hcg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqwp-8wgc-8hcg.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T12:14:14Z"}]}}],"modified":"2026-09-30T17:02:11.420774183Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453","https://github.com/elasticsearch","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37727.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37727"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:83906085-f63b-446f-84ac-02693add0a77","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqwp-8wgc-8hcg","advisory_id":"83906085-f63b-446f-84ac-02693add0a77","event_types":["advisory"],"published_at":"2026-10-25T12:30:25.501159+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/45232"},"members":[{"id":45232,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xqwp-8wgc-8hcg","summary":"CGA-xqwp-8wgc-8hcg","evidence":"osv:CGA-xqwp-8wgc-8hcg","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xqwp-8wgc-8hcg","aliases":["CGA-xqwp-8wgc-8hcg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xqwp-8wgc-8hcg.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-30T12:14:14Z"}]}}],"modified":"2026-09-30T17:02:11.420774183Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453","https://github.com/elasticsearch","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37727.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37727"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:83906085-f63b-446f-84ac-02693add0a77","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xqwp-8wgc-8hcg","advisory_id":"83906085-f63b-446f-84ac-02693add0a77","event_types":["advisory"],"published_at":"2026-10-25T12:30:25.501159+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/45232"}]}},{"id":31182,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-843g-5cpw-4g6g","summary":"MINI-843g-5cpw-4g6g","evidence":"osv:MINI-843g-5cpw-4g6g","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.32-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-843g-5cpw-4g6g","aliases":["MINI-843g-5cpw-4g6g"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.32-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-843g-5cpw-4g6g.json"}}],"modified":"2026-09-29T18:23:24.814533007Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:09be467d-48de-41ca-b481-8481f4d9f2d1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-843g-5cpw-4g6g","advisory_id":"09be467d-48de-41ca-b481-8481f4d9f2d1","event_types":["advisory"],"published_at":"2026-10-25T08:24:28.017058+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/advisories/advisory%3A09be467d-48de-41ca-b481-8481f4d9f2d1","group":{"id":"advisory:09be467d-48de-41ca-b481-8481f4d9f2d1","revision":1,"primary_event_id":30928,"change":"published","superseded_by":[],"changed":{"id":30928,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-843g-5cpw-4g6g","summary":"MINI-843g-5cpw-4g6g","evidence":"osv:MINI-843g-5cpw-4g6g","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.32-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-843g-5cpw-4g6g","aliases":["MINI-843g-5cpw-4g6g"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.32-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-843g-5cpw-4g6g.json"}}],"modified":"2026-09-29T18:23:24.814533007Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:09be467d-48de-41ca-b481-8481f4d9f2d1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-843g-5cpw-4g6g","advisory_id":"09be467d-48de-41ca-b481-8481f4d9f2d1","event_types":["advisory"],"published_at":"2026-10-25T08:24:28.017058+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/events/30928"},"members":[{"id":30928,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-843g-5cpw-4g6g","summary":"MINI-843g-5cpw-4g6g","evidence":"osv:MINI-843g-5cpw-4g6g","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.32-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-843g-5cpw-4g6g","aliases":["MINI-843g-5cpw-4g6g"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.32-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-843g-5cpw-4g6g.json"}}],"modified":"2026-09-29T18:23:24.814533007Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:09be467d-48de-41ca-b481-8481f4d9f2d1","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-843g-5cpw-4g6g","advisory_id":"09be467d-48de-41ca-b481-8481f4d9f2d1","event_types":["advisory"],"published_at":"2026-10-25T08:24:28.017058+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/events/30928"}]}},{"id":31181,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-83mp-9qg2-jwx8","summary":"MINI-83mp-9qg2-jwx8","evidence":"osv:MINI-83mp-9qg2-jwx8","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.36-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-83mp-9qg2-jwx8","aliases":["MINI-83mp-9qg2-jwx8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.36-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-83mp-9qg2-jwx8.json"}}],"modified":"2026-09-29T18:23:24.618136319Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7f71192-e468-4b0e-bc0a-9a13e722083b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-83mp-9qg2-jwx8","advisory_id":"e7f71192-e468-4b0e-bc0a-9a13e722083b","event_types":["advisory"],"published_at":"2026-10-25T08:24:27.398195+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/advisories/advisory%3Ae7f71192-e468-4b0e-bc0a-9a13e722083b","group":{"id":"advisory:e7f71192-e468-4b0e-bc0a-9a13e722083b","revision":1,"primary_event_id":30927,"change":"published","superseded_by":[],"changed":{"id":30927,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-83mp-9qg2-jwx8","summary":"MINI-83mp-9qg2-jwx8","evidence":"osv:MINI-83mp-9qg2-jwx8","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.36-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-83mp-9qg2-jwx8","aliases":["MINI-83mp-9qg2-jwx8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.36-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-83mp-9qg2-jwx8.json"}}],"modified":"2026-09-29T18:23:24.618136319Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7f71192-e468-4b0e-bc0a-9a13e722083b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-83mp-9qg2-jwx8","advisory_id":"e7f71192-e468-4b0e-bc0a-9a13e722083b","event_types":["advisory"],"published_at":"2026-10-25T08:24:27.398195+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/events/30927"},"members":[{"id":30927,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-83mp-9qg2-jwx8","summary":"MINI-83mp-9qg2-jwx8","evidence":"osv:MINI-83mp-9qg2-jwx8","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.36-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-83mp-9qg2-jwx8","aliases":["MINI-83mp-9qg2-jwx8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.36-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-83mp-9qg2-jwx8.json"}}],"modified":"2026-09-29T18:23:24.618136319Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7f71192-e468-4b0e-bc0a-9a13e722083b","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-83mp-9qg2-jwx8","advisory_id":"e7f71192-e468-4b0e-bc0a-9a13e722083b","event_types":["advisory"],"published_at":"2026-10-25T08:24:27.398195+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/events/30927"}]}},{"id":31110,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-749m-82wq-h9mr","summary":"MINI-749m-82wq-h9mr","evidence":"osv:MINI-749m-82wq-h9mr","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.36-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-749m-82wq-h9mr","aliases":["MINI-749m-82wq-h9mr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.36-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-749m-82wq-h9mr.json"}}],"modified":"2026-09-29T18:23:17.955904704Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:29154845-9e6f-4b55-b917-444c2f9f785c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-749m-82wq-h9mr","advisory_id":"29154845-9e6f-4b55-b917-444c2f9f785c","event_types":["advisory"],"published_at":"2026-10-25T08:22:57.860543+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/advisories/advisory%3A29154845-9e6f-4b55-b917-444c2f9f785c","group":{"id":"advisory:29154845-9e6f-4b55-b917-444c2f9f785c","revision":1,"primary_event_id":30857,"change":"published","superseded_by":[],"changed":{"id":30857,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-749m-82wq-h9mr","summary":"MINI-749m-82wq-h9mr","evidence":"osv:MINI-749m-82wq-h9mr","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.36-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-749m-82wq-h9mr","aliases":["MINI-749m-82wq-h9mr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.36-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-749m-82wq-h9mr.json"}}],"modified":"2026-09-29T18:23:17.955904704Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:29154845-9e6f-4b55-b917-444c2f9f785c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-749m-82wq-h9mr","advisory_id":"29154845-9e6f-4b55-b917-444c2f9f785c","event_types":["advisory"],"published_at":"2026-10-25T08:22:57.860543+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/events/30857"},"members":[{"id":30857,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-749m-82wq-h9mr","summary":"MINI-749m-82wq-h9mr","evidence":"osv:MINI-749m-82wq-h9mr","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.36-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-749m-82wq-h9mr","aliases":["MINI-749m-82wq-h9mr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.36-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-749m-82wq-h9mr.json"}}],"modified":"2026-09-29T18:23:17.955904704Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:29154845-9e6f-4b55-b917-444c2f9f785c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-749m-82wq-h9mr","advisory_id":"29154845-9e6f-4b55-b917-444c2f9f785c","event_types":["advisory"],"published_at":"2026-10-25T08:22:57.860543+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/events/30857"}]}},{"id":31090,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-9rgh-47f2-mv2p","summary":"MINI-9rgh-47f2-mv2p","evidence":"osv:MINI-9rgh-47f2-mv2p","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.36-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-9rgh-47f2-mv2p","aliases":["MINI-9rgh-47f2-mv2p"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.36-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-9rgh-47f2-mv2p.json"}}],"modified":"2026-09-29T18:23:16.164787644Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7de89146-585d-4d30-9757-d69f400080de","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-9rgh-47f2-mv2p","advisory_id":"7de89146-585d-4d30-9757-d69f400080de","event_types":["advisory"],"published_at":"2026-10-25T08:22:45.484238+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/advisories/advisory%3A7de89146-585d-4d30-9757-d69f400080de","group":{"id":"advisory:7de89146-585d-4d30-9757-d69f400080de","revision":1,"primary_event_id":30837,"change":"published","superseded_by":[],"changed":{"id":30837,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-9rgh-47f2-mv2p","summary":"MINI-9rgh-47f2-mv2p","evidence":"osv:MINI-9rgh-47f2-mv2p","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.36-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-9rgh-47f2-mv2p","aliases":["MINI-9rgh-47f2-mv2p"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.36-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-9rgh-47f2-mv2p.json"}}],"modified":"2026-09-29T18:23:16.164787644Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7de89146-585d-4d30-9757-d69f400080de","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-9rgh-47f2-mv2p","advisory_id":"7de89146-585d-4d30-9757-d69f400080de","event_types":["advisory"],"published_at":"2026-10-25T08:22:45.484238+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/events/30837"},"members":[{"id":30837,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-9rgh-47f2-mv2p","summary":"MINI-9rgh-47f2-mv2p","evidence":"osv:MINI-9rgh-47f2-mv2p","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.36-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-9rgh-47f2-mv2p","aliases":["MINI-9rgh-47f2-mv2p"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.36-r0"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/minimos/camunda-8.8","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-9rgh-47f2-mv2p.json"}}],"modified":"2026-09-29T18:23:16.164787644Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7de89146-585d-4d30-9757-d69f400080de","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-9rgh-47f2-mv2p","advisory_id":"7de89146-585d-4d30-9757-d69f400080de","event_types":["advisory"],"published_at":"2026-10-25T08:22:45.484238+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:26:28+00:00","detail_url":"/events/30837"}]}},{"id":19275,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-j76f-3qx9-vrrw","summary":"CGA-j76f-3qx9-vrrw","evidence":"osv:CGA-j76f-3qx9-vrrw","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j76f-3qx9-vrrw","aliases":["CGA-j76f-3qx9-vrrw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j76f-3qx9-vrrw.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T12:48:21Z"}]}}],"modified":"2026-09-26T16:15:22.308189602Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37731.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37731"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ab2d9cfe-4c4e-4aee-9a07-bb890a46c6c2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j76f-3qx9-vrrw","advisory_id":"ab2d9cfe-4c4e-4aee-9a07-bb890a46c6c2","event_types":["advisory"],"published_at":"2026-10-25T02:04:40.405459+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/advisories/advisory%3Aab2d9cfe-4c4e-4aee-9a07-bb890a46c6c2","group":{"id":"advisory:ab2d9cfe-4c4e-4aee-9a07-bb890a46c6c2","revision":1,"primary_event_id":19140,"change":"published","superseded_by":[],"changed":{"id":19140,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-j76f-3qx9-vrrw","summary":"CGA-j76f-3qx9-vrrw","evidence":"osv:CGA-j76f-3qx9-vrrw","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j76f-3qx9-vrrw","aliases":["CGA-j76f-3qx9-vrrw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j76f-3qx9-vrrw.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T12:48:21Z"}]}}],"modified":"2026-09-26T16:15:22.308189602Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37731.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37731"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ab2d9cfe-4c4e-4aee-9a07-bb890a46c6c2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j76f-3qx9-vrrw","advisory_id":"ab2d9cfe-4c4e-4aee-9a07-bb890a46c6c2","event_types":["advisory"],"published_at":"2026-10-25T02:04:40.405459+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/19140"},"members":[{"id":19140,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-j76f-3qx9-vrrw","summary":"CGA-j76f-3qx9-vrrw","evidence":"osv:CGA-j76f-3qx9-vrrw","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j76f-3qx9-vrrw","aliases":["CGA-j76f-3qx9-vrrw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j76f-3qx9-vrrw.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T12:48:21Z"}]}}],"modified":"2026-09-26T16:15:22.308189602Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37731.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37731"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ab2d9cfe-4c4e-4aee-9a07-bb890a46c6c2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j76f-3qx9-vrrw","advisory_id":"ab2d9cfe-4c4e-4aee-9a07-bb890a46c6c2","event_types":["advisory"],"published_at":"2026-10-25T02:04:40.405459+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/19140"}]}},{"id":19232,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xwg6-hvhw-x5w5","summary":"CGA-xwg6-hvhw-x5w5","evidence":"osv:CGA-xwg6-hvhw-x5w5","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xwg6-hvhw-x5w5","aliases":["CGA-xwg6-hvhw-x5w5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xwg6-hvhw-x5w5.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T12:48:21Z"}]}}],"modified":"2026-09-26T16:15:10.216567708Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919","https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52980.json","https://nvd.nist.gov/vuln/detail/CVE-2024-52980"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4701ffe6-e183-4aa6-8dc2-1963fe595da2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xwg6-hvhw-x5w5","advisory_id":"4701ffe6-e183-4aa6-8dc2-1963fe595da2","event_types":["advisory"],"published_at":"2026-10-25T02:03:29.448867+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/advisories/advisory%3A4701ffe6-e183-4aa6-8dc2-1963fe595da2","group":{"id":"advisory:4701ffe6-e183-4aa6-8dc2-1963fe595da2","revision":1,"primary_event_id":19097,"change":"published","superseded_by":[],"changed":{"id":19097,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xwg6-hvhw-x5w5","summary":"CGA-xwg6-hvhw-x5w5","evidence":"osv:CGA-xwg6-hvhw-x5w5","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xwg6-hvhw-x5w5","aliases":["CGA-xwg6-hvhw-x5w5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xwg6-hvhw-x5w5.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T12:48:21Z"}]}}],"modified":"2026-09-26T16:15:10.216567708Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919","https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52980.json","https://nvd.nist.gov/vuln/detail/CVE-2024-52980"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4701ffe6-e183-4aa6-8dc2-1963fe595da2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xwg6-hvhw-x5w5","advisory_id":"4701ffe6-e183-4aa6-8dc2-1963fe595da2","event_types":["advisory"],"published_at":"2026-10-25T02:03:29.448867+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/19097"},"members":[{"id":19097,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xwg6-hvhw-x5w5","summary":"CGA-xwg6-hvhw-x5w5","evidence":"osv:CGA-xwg6-hvhw-x5w5","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xwg6-hvhw-x5w5","aliases":["CGA-xwg6-hvhw-x5w5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xwg6-hvhw-x5w5.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T12:48:21Z"}]}}],"modified":"2026-09-26T16:15:10.216567708Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919","https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52980.json","https://nvd.nist.gov/vuln/detail/CVE-2024-52980"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4701ffe6-e183-4aa6-8dc2-1963fe595da2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xwg6-hvhw-x5w5","advisory_id":"4701ffe6-e183-4aa6-8dc2-1963fe595da2","event_types":["advisory"],"published_at":"2026-10-25T02:03:29.448867+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/19097"}]}},{"id":19060,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pjq5-v2f8-8697","summary":"CGA-pjq5-v2f8-8697","evidence":"osv:CGA-pjq5-v2f8-8697","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pjq5-v2f8-8697","aliases":["CGA-pjq5-v2f8-8697"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pjq5-v2f8-8697.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T04:03:38Z"}]}}],"modified":"2026-09-26T10:17:14.449352272Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37731.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37731"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4ea9ff9d-ed73-4f8a-bffd-19821fcf17b7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pjq5-v2f8-8697","advisory_id":"4ea9ff9d-ed73-4f8a-bffd-19821fcf17b7","event_types":["advisory"],"published_at":"2026-10-25T02:00:58.069342+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/advisories/advisory%3A4ea9ff9d-ed73-4f8a-bffd-19821fcf17b7","group":{"id":"advisory:4ea9ff9d-ed73-4f8a-bffd-19821fcf17b7","revision":1,"primary_event_id":18927,"change":"published","superseded_by":[],"changed":{"id":18927,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pjq5-v2f8-8697","summary":"CGA-pjq5-v2f8-8697","evidence":"osv:CGA-pjq5-v2f8-8697","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pjq5-v2f8-8697","aliases":["CGA-pjq5-v2f8-8697"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pjq5-v2f8-8697.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T04:03:38Z"}]}}],"modified":"2026-09-26T10:17:14.449352272Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37731.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37731"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4ea9ff9d-ed73-4f8a-bffd-19821fcf17b7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pjq5-v2f8-8697","advisory_id":"4ea9ff9d-ed73-4f8a-bffd-19821fcf17b7","event_types":["advisory"],"published_at":"2026-10-25T02:00:58.069342+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/18927"},"members":[{"id":18927,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pjq5-v2f8-8697","summary":"CGA-pjq5-v2f8-8697","evidence":"osv:CGA-pjq5-v2f8-8697","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pjq5-v2f8-8697","aliases":["CGA-pjq5-v2f8-8697"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pjq5-v2f8-8697.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T04:03:38Z"}]}}],"modified":"2026-09-26T10:17:14.449352272Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063","https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37731.json","https://nvd.nist.gov/vuln/detail/CVE-2025-37731"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4ea9ff9d-ed73-4f8a-bffd-19821fcf17b7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pjq5-v2f8-8697","advisory_id":"4ea9ff9d-ed73-4f8a-bffd-19821fcf17b7","event_types":["advisory"],"published_at":"2026-10-25T02:00:58.069342+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/18927"}]}},{"id":19047,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pjcg-g395-cp55","summary":"CGA-pjcg-g395-cp55","evidence":"osv:CGA-pjcg-g395-cp55","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pjcg-g395-cp55","aliases":["CGA-pjcg-g395-cp55"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pjcg-g395-cp55.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T04:03:38Z"}]}}],"modified":"2026-09-26T10:17:09.489027558Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919","https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52980.json","https://nvd.nist.gov/vuln/detail/CVE-2024-52980"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:28c945c9-7363-46ee-8eef-d62e394f1fe0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pjcg-g395-cp55","advisory_id":"28c945c9-7363-46ee-8eef-d62e394f1fe0","event_types":["advisory"],"published_at":"2026-10-25T02:00:50.394985+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/advisories/advisory%3A28c945c9-7363-46ee-8eef-d62e394f1fe0","group":{"id":"advisory:28c945c9-7363-46ee-8eef-d62e394f1fe0","revision":1,"primary_event_id":18914,"change":"published","superseded_by":[],"changed":{"id":18914,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pjcg-g395-cp55","summary":"CGA-pjcg-g395-cp55","evidence":"osv:CGA-pjcg-g395-cp55","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pjcg-g395-cp55","aliases":["CGA-pjcg-g395-cp55"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pjcg-g395-cp55.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T04:03:38Z"}]}}],"modified":"2026-09-26T10:17:09.489027558Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919","https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52980.json","https://nvd.nist.gov/vuln/detail/CVE-2024-52980"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:28c945c9-7363-46ee-8eef-d62e394f1fe0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pjcg-g395-cp55","advisory_id":"28c945c9-7363-46ee-8eef-d62e394f1fe0","event_types":["advisory"],"published_at":"2026-10-25T02:00:50.394985+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/18914"},"members":[{"id":18914,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pjcg-g395-cp55","summary":"CGA-pjcg-g395-cp55","evidence":"osv:CGA-pjcg-g395-cp55","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.39-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pjcg-g395-cp55","aliases":["CGA-pjcg-g395-cp55"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.39-r1"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pjcg-g395-cp55.json"},"ecosystem_specific":{"components":[{"component_name":"elasticsearch","component_purl":"pkg:maven/elasticsearch@7.17.29","component_type":"java-archive","component_version":"7.17.29","component_location":"/usr/share/java/camunda/lib/elasticsearch-7.17.29.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-26T04:03:38Z"}]}}],"modified":"2026-09-26T10:17:09.489027558Z","provider":"osv","references":["https://discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919","https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52980.json","https://nvd.nist.gov/vuln/detail/CVE-2024-52980"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:28c945c9-7363-46ee-8eef-d62e394f1fe0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pjcg-g395-cp55","advisory_id":"28c945c9-7363-46ee-8eef-d62e394f1fe0","event_types":["advisory"],"published_at":"2026-10-25T02:00:50.394985+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-01-05T22:38:27+00:00","detail_url":"/events/18914"}]}},{"id":12958,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4xfh-3p43-f7qh","summary":"CGA-4xfh-3p43-f7qh","evidence":"osv:CGA-4xfh-3p43-f7qh","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4xfh-3p43-f7qh","aliases":["CGA-4xfh-3p43-f7qh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4xfh-3p43-f7qh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:00:14Z"}]}}],"modified":"2026-10-02T05:15:09.683469736Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bb3f80d5-ed6e-4fa4-a636-eaa2676a5d03","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4xfh-3p43-f7qh","advisory_id":"bb3f80d5-ed6e-4fa4-a636-eaa2676a5d03","event_types":["advisory"],"published_at":"2026-10-25T20:35:12.150039+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:18:57+00:00","detail_url":"/advisories/advisory%3Abb3f80d5-ed6e-4fa4-a636-eaa2676a5d03","group":{"id":"advisory:bb3f80d5-ed6e-4fa4-a636-eaa2676a5d03","revision":1,"primary_event_id":65408,"change":"published","superseded_by":[],"changed":{"id":65408,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4xfh-3p43-f7qh","summary":"CGA-4xfh-3p43-f7qh","evidence":"osv:CGA-4xfh-3p43-f7qh","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4xfh-3p43-f7qh","aliases":["CGA-4xfh-3p43-f7qh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4xfh-3p43-f7qh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:00:14Z"}]}}],"modified":"2026-10-02T05:15:09.683469736Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bb3f80d5-ed6e-4fa4-a636-eaa2676a5d03","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4xfh-3p43-f7qh","advisory_id":"bb3f80d5-ed6e-4fa4-a636-eaa2676a5d03","event_types":["advisory"],"published_at":"2026-10-25T20:35:12.150039+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:18:57+00:00","detail_url":"/events/65408"},"members":[{"id":65408,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4xfh-3p43-f7qh","summary":"CGA-4xfh-3p43-f7qh","evidence":"osv:CGA-4xfh-3p43-f7qh","products":[{"name":{"value":"camunda-8.8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.8.40-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4xfh-3p43-f7qh","aliases":["CGA-4xfh-3p43-f7qh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.40-r2"}]}],"package":{"name":"camunda-8.8","purl":"pkg:apk/chainguard/camunda-8.8?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4xfh-3p43-f7qh.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/camunda/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T00:00:14Z"}]}}],"modified":"2026-10-02T05:15:09.683469736Z","provider":"osv","references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bb3f80d5-ed6e-4fa4-a636-eaa2676a5d03","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4xfh-3p43-f7qh","advisory_id":"bb3f80d5-ed6e-4fa4-a636-eaa2676a5d03","event_types":["advisory"],"published_at":"2026-10-25T20:35:12.150039+00:00","technologies":["camunda-8-8","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:18:57+00:00","detail_url":"/events/65408"}]}}],"next_after":72042,"next_before":12958}