{"schema_version":"2","view":"grouped","data":[{"id":71569,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-5x7h-4pjh-wc53","summary":"CGA-5x7h-4pjh-wc53","evidence":"osv:CGA-5x7h-4pjh-wc53","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5x7h-4pjh-wc53","aliases":["CGA-5x7h-4pjh-wc53"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5x7h-4pjh-wc53.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5x7h-4pjh-wc53.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}}],"modified":"2026-10-02T23:01:06.364131081Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:36c0af13-f590-4d6e-a10d-a6ee57dba941","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5x7h-4pjh-wc53","advisory_id":"36c0af13-f590-4d6e-a10d-a6ee57dba941","event_types":["advisory"],"published_at":"2026-10-25T23:19:53.730493+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:02:01+00:00","detail_url":"/advisories/advisory%3A36c0af13-f590-4d6e-a10d-a6ee57dba941","group":{"id":"advisory:36c0af13-f590-4d6e-a10d-a6ee57dba941","revision":1,"primary_event_id":71986,"change":"published","superseded_by":[],"changed":{"id":71986,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-5x7h-4pjh-wc53","summary":"CGA-5x7h-4pjh-wc53","evidence":"osv:CGA-5x7h-4pjh-wc53","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5x7h-4pjh-wc53","aliases":["CGA-5x7h-4pjh-wc53"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5x7h-4pjh-wc53.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5x7h-4pjh-wc53.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}}],"modified":"2026-10-02T23:01:06.364131081Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:36c0af13-f590-4d6e-a10d-a6ee57dba941","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5x7h-4pjh-wc53","advisory_id":"36c0af13-f590-4d6e-a10d-a6ee57dba941","event_types":["advisory"],"published_at":"2026-10-25T23:19:53.730493+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:02:01+00:00","detail_url":"/events/71986"},"members":[{"id":71986,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-5x7h-4pjh-wc53","summary":"CGA-5x7h-4pjh-wc53","evidence":"osv:CGA-5x7h-4pjh-wc53","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5x7h-4pjh-wc53","aliases":["CGA-5x7h-4pjh-wc53"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5x7h-4pjh-wc53.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5x7h-4pjh-wc53.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}}],"modified":"2026-10-02T23:01:06.364131081Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:36c0af13-f590-4d6e-a10d-a6ee57dba941","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5x7h-4pjh-wc53","advisory_id":"36c0af13-f590-4d6e-a10d-a6ee57dba941","event_types":["advisory"],"published_at":"2026-10-25T23:19:53.730493+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:02:01+00:00","detail_url":"/events/71986"}]}},{"id":71563,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-wx2q-c96v-rr2j","summary":"CGA-wx2q-c96v-rr2j","evidence":"osv:CGA-wx2q-c96v-rr2j","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wx2q-c96v-rr2j","aliases":["CGA-wx2q-c96v-rr2j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wx2q-c96v-rr2j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wx2q-c96v-rr2j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:55Z"}]}}],"modified":"2026-10-02T23:01:05.414486988Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6898c09d-8fec-46e2-a654-edffb84cf0a1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wx2q-c96v-rr2j","advisory_id":"6898c09d-8fec-46e2-a654-edffb84cf0a1","event_types":["advisory"],"published_at":"2026-10-25T23:19:31.41703+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:47:34+00:00","detail_url":"/advisories/advisory%3A6898c09d-8fec-46e2-a654-edffb84cf0a1","group":{"id":"advisory:6898c09d-8fec-46e2-a654-edffb84cf0a1","revision":1,"primary_event_id":71979,"change":"published","superseded_by":[],"changed":{"id":71979,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-wx2q-c96v-rr2j","summary":"CGA-wx2q-c96v-rr2j","evidence":"osv:CGA-wx2q-c96v-rr2j","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wx2q-c96v-rr2j","aliases":["CGA-wx2q-c96v-rr2j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wx2q-c96v-rr2j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wx2q-c96v-rr2j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:55Z"}]}}],"modified":"2026-10-02T23:01:05.414486988Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6898c09d-8fec-46e2-a654-edffb84cf0a1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wx2q-c96v-rr2j","advisory_id":"6898c09d-8fec-46e2-a654-edffb84cf0a1","event_types":["advisory"],"published_at":"2026-10-25T23:19:31.41703+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:47:34+00:00","detail_url":"/events/71979"},"members":[{"id":71979,"cve_ids":["CVE-2026-89407"],"payload":{"kind":"advisory","title":"CGA-wx2q-c96v-rr2j","summary":"CGA-wx2q-c96v-rr2j","evidence":"osv:CGA-wx2q-c96v-rr2j","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wx2q-c96v-rr2j","aliases":["CGA-wx2q-c96v-rr2j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wx2q-c96v-rr2j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wx2q-c96v-rr2j.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:55Z"}]}}],"modified":"2026-10-02T23:01:05.414486988Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":[]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6898c09d-8fec-46e2-a654-edffb84cf0a1","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-89407","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.18.11","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.17.0","evidence":"/affected/0/versions"},{"value":"2.17.1","evidence":"/affected/0/versions"},{"value":"2.17.2","evidence":"/affected/0/versions"},{"value":"2.17.3","evidence":"/affected/0/versions"},{"value":"2.18.0","evidence":"/affected/0/versions"},{"value":"2.18.0-rc1","evidence":"/affected/0/versions"},{"value":"2.18.1","evidence":"/affected/0/versions"},{"value":"2.18.10","evidence":"/affected/0/versions"},{"value":"2.18.2","evidence":"/affected/0/versions"},{"value":"2.18.3","evidence":"/affected/0/versions"},{"value":"2.18.4","evidence":"/affected/0/versions"},{"value":"2.18.4.1","evidence":"/affected/0/versions"},{"value":"2.18.5","evidence":"/affected/0/versions"},{"value":"2.18.6","evidence":"/affected/0/versions"},{"value":"2.18.7","evidence":"/affected/0/versions"},{"value":"2.18.8","evidence":"/affected/0/versions"},{"value":"2.18.9","evidence":"/affected/0/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.21.7","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.19.0","evidence":"/affected/1/versions"},{"value":"2.19.1","evidence":"/affected/1/versions"},{"value":"2.19.2","evidence":"/affected/1/versions"},{"value":"2.19.3","evidence":"/affected/1/versions"},{"value":"2.19.4","evidence":"/affected/1/versions"},{"value":"2.20.0","evidence":"/affected/1/versions"},{"value":"2.20.0-rc1","evidence":"/affected/1/versions"},{"value":"2.20.1","evidence":"/affected/1/versions"},{"value":"2.20.2","evidence":"/affected/1/versions"},{"value":"2.21.0","evidence":"/affected/1/versions"},{"value":"2.21.1","evidence":"/affected/1/versions"},{"value":"2.21.2","evidence":"/affected/1/versions"},{"value":"2.21.3","evidence":"/affected/1/versions"},{"value":"2.21.4","evidence":"/affected/1/versions"},{"value":"2.21.5","evidence":"/affected/1/versions"},{"value":"2.21.6","evidence":"/affected/1/versions"}]},{"name":{"value":"com.fasterxml.jackson.core:jackson-core","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.22.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"2.22.0","evidence":"/affected/2/versions"},{"value":"2.22.1","evidence":"/affected/2/versions"},{"value":"2.22.2","evidence":"/affected/2/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.1.7","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/3/versions"},{"value":"3.0.1","evidence":"/affected/3/versions"},{"value":"3.0.2","evidence":"/affected/3/versions"},{"value":"3.0.3","evidence":"/affected/3/versions"},{"value":"3.0.4","evidence":"/affected/3/versions"},{"value":"3.1.0","evidence":"/affected/3/versions"},{"value":"3.1.0-rc1","evidence":"/affected/3/versions"},{"value":"3.1.1","evidence":"/affected/3/versions"},{"value":"3.1.2","evidence":"/affected/3/versions"},{"value":"3.1.3","evidence":"/affected/3/versions"},{"value":"3.1.4","evidence":"/affected/3/versions"},{"value":"3.1.5","evidence":"/affected/3/versions"},{"value":"3.1.6","evidence":"/affected/3/versions"}]},{"name":{"value":"tools.jackson.core:jackson-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.2.2","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"3.2.0","evidence":"/affected/4/versions"},{"value":"3.2.1","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wx2q-c96v-rr2j","advisory_id":"6898c09d-8fec-46e2-a654-edffb84cf0a1","event_types":["advisory"],"published_at":"2026-10-25T23:19:31.41703+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:47:34+00:00","detail_url":"/events/71979"}]}},{"id":71146,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2fr7-6xmh-qvv8","summary":"CGA-2fr7-6xmh-qvv8","evidence":"osv:CGA-2fr7-6xmh-qvv8","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2fr7-6xmh-qvv8","aliases":["CGA-2fr7-6xmh-qvv8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2fr7-6xmh-qvv8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:56Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2fr7-6xmh-qvv8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:56Z"}]}}],"modified":"2026-10-02T23:00:21.096621622Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a28f5e7c-8477-4610-9ba1-704a3b52eda3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2fr7-6xmh-qvv8","advisory_id":"a28f5e7c-8477-4610-9ba1-704a3b52eda3","event_types":["advisory"],"published_at":"2026-10-25T22:53:06.003987+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:47:33+00:00","detail_url":"/advisories/advisory%3Aa28f5e7c-8477-4610-9ba1-704a3b52eda3","group":{"id":"advisory:a28f5e7c-8477-4610-9ba1-704a3b52eda3","revision":1,"primary_event_id":71523,"change":"published","superseded_by":[],"changed":{"id":71523,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2fr7-6xmh-qvv8","summary":"CGA-2fr7-6xmh-qvv8","evidence":"osv:CGA-2fr7-6xmh-qvv8","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2fr7-6xmh-qvv8","aliases":["CGA-2fr7-6xmh-qvv8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2fr7-6xmh-qvv8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:56Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2fr7-6xmh-qvv8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:56Z"}]}}],"modified":"2026-10-02T23:00:21.096621622Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a28f5e7c-8477-4610-9ba1-704a3b52eda3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2fr7-6xmh-qvv8","advisory_id":"a28f5e7c-8477-4610-9ba1-704a3b52eda3","event_types":["advisory"],"published_at":"2026-10-25T22:53:06.003987+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:47:33+00:00","detail_url":"/events/71523"},"members":[{"id":71523,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2fr7-6xmh-qvv8","summary":"CGA-2fr7-6xmh-qvv8","evidence":"osv:CGA-2fr7-6xmh-qvv8","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2fr7-6xmh-qvv8","aliases":["CGA-2fr7-6xmh-qvv8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2fr7-6xmh-qvv8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:56Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2fr7-6xmh-qvv8.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:55:56Z"}]}}],"modified":"2026-10-02T23:00:21.096621622Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a28f5e7c-8477-4610-9ba1-704a3b52eda3","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2fr7-6xmh-qvv8","advisory_id":"a28f5e7c-8477-4610-9ba1-704a3b52eda3","event_types":["advisory"],"published_at":"2026-10-25T22:53:06.003987+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:47:33+00:00","detail_url":"/events/71523"}]}},{"id":70997,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2h57-rwx4-hv26","summary":"CGA-2h57-rwx4-hv26","evidence":"osv:CGA-2h57-rwx4-hv26","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2h57-rwx4-hv26","aliases":["CGA-2h57-rwx4-hv26"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h57-rwx4-hv26.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h57-rwx4-hv26.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}}],"modified":"2026-10-02T23:00:04.240558407Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:174786bf-40a6-4694-aecd-68cfc6d32a24","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2h57-rwx4-hv26","advisory_id":"174786bf-40a6-4694-aecd-68cfc6d32a24","event_types":["advisory"],"published_at":"2026-10-25T22:46:20.629378+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:02:00+00:00","detail_url":"/advisories/advisory%3A174786bf-40a6-4694-aecd-68cfc6d32a24","group":{"id":"advisory:174786bf-40a6-4694-aecd-68cfc6d32a24","revision":1,"primary_event_id":71371,"change":"published","superseded_by":[],"changed":{"id":71371,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2h57-rwx4-hv26","summary":"CGA-2h57-rwx4-hv26","evidence":"osv:CGA-2h57-rwx4-hv26","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2h57-rwx4-hv26","aliases":["CGA-2h57-rwx4-hv26"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h57-rwx4-hv26.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h57-rwx4-hv26.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}}],"modified":"2026-10-02T23:00:04.240558407Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:174786bf-40a6-4694-aecd-68cfc6d32a24","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2h57-rwx4-hv26","advisory_id":"174786bf-40a6-4694-aecd-68cfc6d32a24","event_types":["advisory"],"published_at":"2026-10-25T22:46:20.629378+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:02:00+00:00","detail_url":"/events/71371"},"members":[{"id":71371,"cve_ids":["CVE-2026-89425"],"payload":{"kind":"advisory","title":"CGA-2h57-rwx4-hv26","summary":"CGA-2h57-rwx4-hv26","evidence":"osv:CGA-2h57-rwx4-hv26","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2h57-rwx4-hv26","aliases":["CGA-2h57-rwx4-hv26"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h57-rwx4-hv26.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r3"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h57-rwx4-hv26.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:50:07Z"}]}}],"modified":"2026-10-02T23:00:04.240558407Z","provider":"osv","upstream":["CVE-2026-89425","GHSA-7hhh-6rmp-j9qf"],"references":[]},"related_cves":[{"value":"CVE-2026-89425","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:174786bf-40a6-4694-aecd-68cfc6d32a24","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2h57-rwx4-hv26","advisory_id":"174786bf-40a6-4694-aecd-68cfc6d32a24","event_types":["advisory"],"published_at":"2026-10-25T22:46:20.629378+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T14:02:00+00:00","detail_url":"/events/71371"}]}},{"id":65680,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pf5x-vgpv-wj69","summary":"CGA-pf5x-vgpv-wj69","evidence":"osv:CGA-pf5x-vgpv-wj69","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pf5x-vgpv-wj69","aliases":["CGA-pf5x-vgpv-wj69"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pf5x-vgpv-wj69.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pf5x-vgpv-wj69.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:09Z"}]}}],"modified":"2026-10-01T23:02:40.329516497Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0051465a-620f-426a-9712-3a413f2010d5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pf5x-vgpv-wj69","advisory_id":"0051465a-620f-426a-9712-3a413f2010d5","event_types":["advisory"],"published_at":"2026-10-25T20:27:33.74322+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:07:27+00:00","detail_url":"/advisories/advisory%3A0051465a-620f-426a-9712-3a413f2010d5","group":{"id":"advisory:0051465a-620f-426a-9712-3a413f2010d5","revision":1,"primary_event_id":64994,"change":"published","superseded_by":[],"changed":{"id":64994,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pf5x-vgpv-wj69","summary":"CGA-pf5x-vgpv-wj69","evidence":"osv:CGA-pf5x-vgpv-wj69","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pf5x-vgpv-wj69","aliases":["CGA-pf5x-vgpv-wj69"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pf5x-vgpv-wj69.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pf5x-vgpv-wj69.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:09Z"}]}}],"modified":"2026-10-01T23:02:40.329516497Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0051465a-620f-426a-9712-3a413f2010d5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pf5x-vgpv-wj69","advisory_id":"0051465a-620f-426a-9712-3a413f2010d5","event_types":["advisory"],"published_at":"2026-10-25T20:27:33.74322+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:07:27+00:00","detail_url":"/events/64994"},"members":[{"id":64994,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pf5x-vgpv-wj69","summary":"CGA-pf5x-vgpv-wj69","evidence":"osv:CGA-pf5x-vgpv-wj69","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pf5x-vgpv-wj69","aliases":["CGA-pf5x-vgpv-wj69"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pf5x-vgpv-wj69.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pf5x-vgpv-wj69.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:09Z"}]}}],"modified":"2026-10-01T23:02:40.329516497Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0051465a-620f-426a-9712-3a413f2010d5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pf5x-vgpv-wj69","advisory_id":"0051465a-620f-426a-9712-3a413f2010d5","event_types":["advisory"],"published_at":"2026-10-25T20:27:33.74322+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:07:27+00:00","detail_url":"/events/64994"}]}},{"id":65206,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-v53p-7mqc-g6fw","summary":"CGA-v53p-7mqc-g6fw","evidence":"osv:CGA-v53p-7mqc-g6fw","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-v53p-7mqc-g6fw","aliases":["CGA-v53p-7mqc-g6fw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v53p-7mqc-g6fw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v53p-7mqc-g6fw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:08Z"}]}}],"modified":"2026-10-01T23:01:28.279201591Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b5b6a19-6c50-459a-ab29-3c4176df04d2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v53p-7mqc-g6fw","advisory_id":"1b5b6a19-6c50-459a-ab29-3c4176df04d2","event_types":["advisory"],"published_at":"2026-10-25T20:19:48.720653+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:07:27+00:00","detail_url":"/advisories/advisory%3A1b5b6a19-6c50-459a-ab29-3c4176df04d2","group":{"id":"advisory:1b5b6a19-6c50-459a-ab29-3c4176df04d2","revision":1,"primary_event_id":64530,"change":"published","superseded_by":[],"changed":{"id":64530,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-v53p-7mqc-g6fw","summary":"CGA-v53p-7mqc-g6fw","evidence":"osv:CGA-v53p-7mqc-g6fw","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-v53p-7mqc-g6fw","aliases":["CGA-v53p-7mqc-g6fw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v53p-7mqc-g6fw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v53p-7mqc-g6fw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:08Z"}]}}],"modified":"2026-10-01T23:01:28.279201591Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b5b6a19-6c50-459a-ab29-3c4176df04d2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v53p-7mqc-g6fw","advisory_id":"1b5b6a19-6c50-459a-ab29-3c4176df04d2","event_types":["advisory"],"published_at":"2026-10-25T20:19:48.720653+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:07:27+00:00","detail_url":"/events/64530"},"members":[{"id":64530,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-v53p-7mqc-g6fw","summary":"CGA-v53p-7mqc-g6fw","evidence":"osv:CGA-v53p-7mqc-g6fw","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-v53p-7mqc-g6fw","aliases":["CGA-v53p-7mqc-g6fw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v53p-7mqc-g6fw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v53p-7mqc-g6fw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T19:05:08Z"}]}}],"modified":"2026-10-01T23:01:28.279201591Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b5b6a19-6c50-459a-ab29-3c4176df04d2","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v53p-7mqc-g6fw","advisory_id":"1b5b6a19-6c50-459a-ab29-3c4176df04d2","event_types":["advisory"],"published_at":"2026-10-25T20:19:48.720653+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:07:27+00:00","detail_url":"/events/64530"}]}},{"id":64952,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-9r7h-vhf2-w5g4","summary":"CGA-9r7h-vhf2-w5g4","evidence":"osv:CGA-9r7h-vhf2-w5g4","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9r7h-vhf2-w5g4","aliases":["CGA-9r7h-vhf2-w5g4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9r7h-vhf2-w5g4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9r7h-vhf2-w5g4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}}],"modified":"2026-10-01T23:00:48.121432936Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:96bd11f0-06ad-426a-96e7-96cf0ac7b609","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9r7h-vhf2-w5g4","advisory_id":"96bd11f0-06ad-426a-96e7-96cf0ac7b609","event_types":["advisory"],"published_at":"2026-10-25T19:58:08.076813+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:05:57+00:00","detail_url":"/advisories/advisory%3A96bd11f0-06ad-426a-96e7-96cf0ac7b609","group":{"id":"advisory:96bd11f0-06ad-426a-96e7-96cf0ac7b609","revision":1,"primary_event_id":64281,"change":"published","superseded_by":[],"changed":{"id":64281,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-9r7h-vhf2-w5g4","summary":"CGA-9r7h-vhf2-w5g4","evidence":"osv:CGA-9r7h-vhf2-w5g4","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9r7h-vhf2-w5g4","aliases":["CGA-9r7h-vhf2-w5g4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9r7h-vhf2-w5g4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9r7h-vhf2-w5g4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}}],"modified":"2026-10-01T23:00:48.121432936Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:96bd11f0-06ad-426a-96e7-96cf0ac7b609","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9r7h-vhf2-w5g4","advisory_id":"96bd11f0-06ad-426a-96e7-96cf0ac7b609","event_types":["advisory"],"published_at":"2026-10-25T19:58:08.076813+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:05:57+00:00","detail_url":"/events/64281"},"members":[{"id":64281,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-9r7h-vhf2-w5g4","summary":"CGA-9r7h-vhf2-w5g4","evidence":"osv:CGA-9r7h-vhf2-w5g4","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9r7h-vhf2-w5g4","aliases":["CGA-9r7h-vhf2-w5g4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9r7h-vhf2-w5g4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9r7h-vhf2-w5g4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}}],"modified":"2026-10-01T23:00:48.121432936Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:96bd11f0-06ad-426a-96e7-96cf0ac7b609","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9r7h-vhf2-w5g4","advisory_id":"96bd11f0-06ad-426a-96e7-96cf0ac7b609","event_types":["advisory"],"published_at":"2026-10-25T19:58:08.076813+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:05:57+00:00","detail_url":"/events/64281"}]}},{"id":64754,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2mv7-82hc-5m8v","summary":"CGA-2mv7-82hc-5m8v","evidence":"osv:CGA-2mv7-82hc-5m8v","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2mv7-82hc-5m8v","aliases":["CGA-2mv7-82hc-5m8v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mv7-82hc-5m8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mv7-82hc-5m8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}}],"modified":"2026-10-01T23:00:23.817610190Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:48bcad99-2b08-4b10-ac73-1033c386b705","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mv7-82hc-5m8v","advisory_id":"48bcad99-2b08-4b10-ac73-1033c386b705","event_types":["advisory"],"published_at":"2026-10-25T19:54:19.1063+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:05:57+00:00","detail_url":"/advisories/advisory%3A48bcad99-2b08-4b10-ac73-1033c386b705","group":{"id":"advisory:48bcad99-2b08-4b10-ac73-1033c386b705","revision":1,"primary_event_id":64094,"change":"published","superseded_by":[],"changed":{"id":64094,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2mv7-82hc-5m8v","summary":"CGA-2mv7-82hc-5m8v","evidence":"osv:CGA-2mv7-82hc-5m8v","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2mv7-82hc-5m8v","aliases":["CGA-2mv7-82hc-5m8v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mv7-82hc-5m8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mv7-82hc-5m8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}}],"modified":"2026-10-01T23:00:23.817610190Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:48bcad99-2b08-4b10-ac73-1033c386b705","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mv7-82hc-5m8v","advisory_id":"48bcad99-2b08-4b10-ac73-1033c386b705","event_types":["advisory"],"published_at":"2026-10-25T19:54:19.1063+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:05:57+00:00","detail_url":"/events/64094"},"members":[{"id":64094,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2mv7-82hc-5m8v","summary":"CGA-2mv7-82hc-5m8v","evidence":"osv:CGA-2mv7-82hc-5m8v","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2mv7-82hc-5m8v","aliases":["CGA-2mv7-82hc-5m8v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mv7-82hc-5m8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r2"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2mv7-82hc-5m8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:37:35Z"}]}}],"modified":"2026-10-01T23:00:23.817610190Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:48bcad99-2b08-4b10-ac73-1033c386b705","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2mv7-82hc-5m8v","advisory_id":"48bcad99-2b08-4b10-ac73-1033c386b705","event_types":["advisory"],"published_at":"2026-10-25T19:54:19.1063+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:05:57+00:00","detail_url":"/events/64094"}]}},{"id":37193,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xfc3-5c79-qfmg","summary":"CGA-xfc3-5c79-qfmg","evidence":"osv:CGA-xfc3-5c79-qfmg","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xfc3-5c79-qfmg","aliases":["CGA-xfc3-5c79-qfmg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfc3-5c79-qfmg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfc3-5c79-qfmg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}}],"modified":"2026-09-30T04:32:26.200621833Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ac9ade3c-ee2e-468e-8f37-eb6a3c9182d5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xfc3-5c79-qfmg","advisory_id":"ac9ade3c-ee2e-468e-8f37-eb6a3c9182d5","event_types":["advisory"],"published_at":"2026-10-25T10:02:39.612632+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:20+00:00","detail_url":"/advisories/advisory%3Aac9ade3c-ee2e-468e-8f37-eb6a3c9182d5","group":{"id":"advisory:ac9ade3c-ee2e-468e-8f37-eb6a3c9182d5","revision":1,"primary_event_id":36865,"change":"published","superseded_by":[],"changed":{"id":36865,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xfc3-5c79-qfmg","summary":"CGA-xfc3-5c79-qfmg","evidence":"osv:CGA-xfc3-5c79-qfmg","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xfc3-5c79-qfmg","aliases":["CGA-xfc3-5c79-qfmg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfc3-5c79-qfmg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfc3-5c79-qfmg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}}],"modified":"2026-09-30T04:32:26.200621833Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ac9ade3c-ee2e-468e-8f37-eb6a3c9182d5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xfc3-5c79-qfmg","advisory_id":"ac9ade3c-ee2e-468e-8f37-eb6a3c9182d5","event_types":["advisory"],"published_at":"2026-10-25T10:02:39.612632+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:20+00:00","detail_url":"/events/36865"},"members":[{"id":36865,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-xfc3-5c79-qfmg","summary":"CGA-xfc3-5c79-qfmg","evidence":"osv:CGA-xfc3-5c79-qfmg","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-xfc3-5c79-qfmg","aliases":["CGA-xfc3-5c79-qfmg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfc3-5c79-qfmg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xfc3-5c79-qfmg.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}}],"modified":"2026-09-30T04:32:26.200621833Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ac9ade3c-ee2e-468e-8f37-eb6a3c9182d5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xfc3-5c79-qfmg","advisory_id":"ac9ade3c-ee2e-468e-8f37-eb6a3c9182d5","event_types":["advisory"],"published_at":"2026-10-25T10:02:39.612632+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:20+00:00","detail_url":"/events/36865"}]}},{"id":36182,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pc4x-4gfx-w3q4","summary":"CGA-pc4x-4gfx-w3q4","evidence":"osv:CGA-pc4x-4gfx-w3q4","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pc4x-4gfx-w3q4","aliases":["CGA-pc4x-4gfx-w3q4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pc4x-4gfx-w3q4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pc4x-4gfx-w3q4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}}],"modified":"2026-09-30T04:32:18.150045087Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ceae7fe1-3de0-4d2a-bd9e-67bc593f6227","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pc4x-4gfx-w3q4","advisory_id":"ceae7fe1-3de0-4d2a-bd9e-67bc593f6227","event_types":["advisory"],"published_at":"2026-10-25T09:46:23.100737+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:04+00:00","detail_url":"/advisories/advisory%3Aceae7fe1-3de0-4d2a-bd9e-67bc593f6227","group":{"id":"advisory:ceae7fe1-3de0-4d2a-bd9e-67bc593f6227","revision":1,"primary_event_id":35868,"change":"published","superseded_by":[],"changed":{"id":35868,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pc4x-4gfx-w3q4","summary":"CGA-pc4x-4gfx-w3q4","evidence":"osv:CGA-pc4x-4gfx-w3q4","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pc4x-4gfx-w3q4","aliases":["CGA-pc4x-4gfx-w3q4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pc4x-4gfx-w3q4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pc4x-4gfx-w3q4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}}],"modified":"2026-09-30T04:32:18.150045087Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ceae7fe1-3de0-4d2a-bd9e-67bc593f6227","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pc4x-4gfx-w3q4","advisory_id":"ceae7fe1-3de0-4d2a-bd9e-67bc593f6227","event_types":["advisory"],"published_at":"2026-10-25T09:46:23.100737+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:04+00:00","detail_url":"/events/35868"},"members":[{"id":35868,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pc4x-4gfx-w3q4","summary":"CGA-pc4x-4gfx-w3q4","evidence":"osv:CGA-pc4x-4gfx-w3q4","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pc4x-4gfx-w3q4","aliases":["CGA-pc4x-4gfx-w3q4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pc4x-4gfx-w3q4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pc4x-4gfx-w3q4.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}}],"modified":"2026-09-30T04:32:18.150045087Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","https://nvd.nist.gov/vuln/detail/CVE-2026-19032","https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","https://github.com/FasterXML/jackson-databind/pull/6129","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ceae7fe1-3de0-4d2a-bd9e-67bc593f6227","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pc4x-4gfx-w3q4","advisory_id":"ceae7fe1-3de0-4d2a-bd9e-67bc593f6227","event_types":["advisory"],"published_at":"2026-10-25T09:46:23.100737+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:04+00:00","detail_url":"/events/35868"}]}},{"id":35769,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-fxpg-vx69-hcwx","summary":"CGA-fxpg-vx69-hcwx","evidence":"osv:CGA-fxpg-vx69-hcwx","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-fxpg-vx69-hcwx","aliases":["CGA-fxpg-vx69-hcwx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fxpg-vx69-hcwx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fxpg-vx69-hcwx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:09Z"}]}}],"modified":"2026-09-30T04:31:41.651896738Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8afcbf76-c050-4942-b995-72585bede196","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fxpg-vx69-hcwx","advisory_id":"8afcbf76-c050-4942-b995-72585bede196","event_types":["advisory"],"published_at":"2026-10-25T09:39:09.579823+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:20+00:00","detail_url":"/advisories/advisory%3A8afcbf76-c050-4942-b995-72585bede196","group":{"id":"advisory:8afcbf76-c050-4942-b995-72585bede196","revision":1,"primary_event_id":35461,"change":"published","superseded_by":[],"changed":{"id":35461,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-fxpg-vx69-hcwx","summary":"CGA-fxpg-vx69-hcwx","evidence":"osv:CGA-fxpg-vx69-hcwx","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-fxpg-vx69-hcwx","aliases":["CGA-fxpg-vx69-hcwx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fxpg-vx69-hcwx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fxpg-vx69-hcwx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:09Z"}]}}],"modified":"2026-09-30T04:31:41.651896738Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8afcbf76-c050-4942-b995-72585bede196","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fxpg-vx69-hcwx","advisory_id":"8afcbf76-c050-4942-b995-72585bede196","event_types":["advisory"],"published_at":"2026-10-25T09:39:09.579823+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:20+00:00","detail_url":"/events/35461"},"members":[{"id":35461,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-fxpg-vx69-hcwx","summary":"CGA-fxpg-vx69-hcwx","evidence":"osv:CGA-fxpg-vx69-hcwx","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-fxpg-vx69-hcwx","aliases":["CGA-fxpg-vx69-hcwx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fxpg-vx69-hcwx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fxpg-vx69-hcwx.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:09Z"}]}}],"modified":"2026-09-30T04:31:41.651896738Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8afcbf76-c050-4942-b995-72585bede196","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fxpg-vx69-hcwx","advisory_id":"8afcbf76-c050-4942-b995-72585bede196","event_types":["advisory"],"published_at":"2026-10-25T09:39:09.579823+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:20+00:00","detail_url":"/events/35461"}]}},{"id":35644,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-cj34-cfxj-fh8v","summary":"CGA-cj34-cfxj-fh8v","evidence":"osv:CGA-cj34-cfxj-fh8v","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-cj34-cfxj-fh8v","aliases":["CGA-cj34-cfxj-fh8v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cj34-cfxj-fh8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cj34-cfxj-fh8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}}],"modified":"2026-09-30T04:31:29.642046140Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ba73a2b4-b019-4084-b0c2-a548a48968d0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cj34-cfxj-fh8v","advisory_id":"ba73a2b4-b019-4084-b0c2-a548a48968d0","event_types":["advisory"],"published_at":"2026-10-25T09:37:51.052231+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:04+00:00","detail_url":"/advisories/advisory%3Aba73a2b4-b019-4084-b0c2-a548a48968d0","group":{"id":"advisory:ba73a2b4-b019-4084-b0c2-a548a48968d0","revision":1,"primary_event_id":35338,"change":"published","superseded_by":[],"changed":{"id":35338,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-cj34-cfxj-fh8v","summary":"CGA-cj34-cfxj-fh8v","evidence":"osv:CGA-cj34-cfxj-fh8v","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-cj34-cfxj-fh8v","aliases":["CGA-cj34-cfxj-fh8v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cj34-cfxj-fh8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cj34-cfxj-fh8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}}],"modified":"2026-09-30T04:31:29.642046140Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ba73a2b4-b019-4084-b0c2-a548a48968d0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cj34-cfxj-fh8v","advisory_id":"ba73a2b4-b019-4084-b0c2-a548a48968d0","event_types":["advisory"],"published_at":"2026-10-25T09:37:51.052231+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:04+00:00","detail_url":"/events/35338"},"members":[{"id":35338,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-cj34-cfxj-fh8v","summary":"CGA-cj34-cfxj-fh8v","evidence":"osv:CGA-cj34-cfxj-fh8v","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-cj34-cfxj-fh8v","aliases":["CGA-cj34-cfxj-fh8v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cj34-cfxj-fh8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cj34-cfxj-fh8v.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:08Z"}]}}],"modified":"2026-09-30T04:31:29.642046140Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ba73a2b4-b019-4084-b0c2-a548a48968d0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cj34-cfxj-fh8v","advisory_id":"ba73a2b4-b019-4084-b0c2-a548a48968d0","event_types":["advisory"],"published_at":"2026-10-25T09:37:51.052231+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:04+00:00","detail_url":"/events/35338"}]}},{"id":35589,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c8x3-q4h5-q64r","summary":"CGA-c8x3-q4h5-q64r","evidence":"osv:CGA-c8x3-q4h5-q64r","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c8x3-q4h5-q64r","aliases":["CGA-c8x3-q4h5-q64r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8x3-q4h5-q64r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8x3-q4h5-q64r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}}],"modified":"2026-09-30T04:31:25.693890776Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:20d8e799-67fc-4c55-a18b-cf087c9effc7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c8x3-q4h5-q64r","advisory_id":"20d8e799-67fc-4c55-a18b-cf087c9effc7","event_types":["advisory"],"published_at":"2026-10-25T09:36:09.564287+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:20+00:00","detail_url":"/advisories/advisory%3A20d8e799-67fc-4c55-a18b-cf087c9effc7","group":{"id":"advisory:20d8e799-67fc-4c55-a18b-cf087c9effc7","revision":1,"primary_event_id":35284,"change":"published","superseded_by":[],"changed":{"id":35284,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c8x3-q4h5-q64r","summary":"CGA-c8x3-q4h5-q64r","evidence":"osv:CGA-c8x3-q4h5-q64r","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c8x3-q4h5-q64r","aliases":["CGA-c8x3-q4h5-q64r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8x3-q4h5-q64r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8x3-q4h5-q64r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}}],"modified":"2026-09-30T04:31:25.693890776Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:20d8e799-67fc-4c55-a18b-cf087c9effc7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c8x3-q4h5-q64r","advisory_id":"20d8e799-67fc-4c55-a18b-cf087c9effc7","event_types":["advisory"],"published_at":"2026-10-25T09:36:09.564287+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:20+00:00","detail_url":"/events/35284"},"members":[{"id":35284,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c8x3-q4h5-q64r","summary":"CGA-c8x3-q4h5-q64r","evidence":"osv:CGA-c8x3-q4h5-q64r","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c8x3-q4h5-q64r","aliases":["CGA-c8x3-q4h5-q64r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8x3-q4h5-q64r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8x3-q4h5-q64r.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T23:05:08Z"}]}}],"modified":"2026-09-30T04:31:25.693890776Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:20d8e799-67fc-4c55-a18b-cf087c9effc7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c8x3-q4h5-q64r","advisory_id":"20d8e799-67fc-4c55-a18b-cf087c9effc7","event_types":["advisory"],"published_at":"2026-10-25T09:36:09.564287+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:20+00:00","detail_url":"/events/35284"}]}},{"id":33897,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-33mr-fmvj-9mvc","summary":"CGA-33mr-fmvj-9mvc","evidence":"osv:CGA-33mr-fmvj-9mvc","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-33mr-fmvj-9mvc","aliases":["CGA-33mr-fmvj-9mvc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-33mr-fmvj-9mvc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-33mr-fmvj-9mvc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:07Z"}]}}],"modified":"2026-09-30T04:30:21.314791845Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6e883124-0b10-4dff-8b59-c273340381f7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-33mr-fmvj-9mvc","advisory_id":"6e883124-0b10-4dff-8b59-c273340381f7","event_types":["advisory"],"published_at":"2026-10-25T09:09:22.874985+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:03+00:00","detail_url":"/advisories/advisory%3A6e883124-0b10-4dff-8b59-c273340381f7","group":{"id":"advisory:6e883124-0b10-4dff-8b59-c273340381f7","revision":1,"primary_event_id":33613,"change":"published","superseded_by":[],"changed":{"id":33613,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-33mr-fmvj-9mvc","summary":"CGA-33mr-fmvj-9mvc","evidence":"osv:CGA-33mr-fmvj-9mvc","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-33mr-fmvj-9mvc","aliases":["CGA-33mr-fmvj-9mvc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-33mr-fmvj-9mvc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-33mr-fmvj-9mvc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:07Z"}]}}],"modified":"2026-09-30T04:30:21.314791845Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6e883124-0b10-4dff-8b59-c273340381f7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-33mr-fmvj-9mvc","advisory_id":"6e883124-0b10-4dff-8b59-c273340381f7","event_types":["advisory"],"published_at":"2026-10-25T09:09:22.874985+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:03+00:00","detail_url":"/events/33613"},"members":[{"id":33613,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-33mr-fmvj-9mvc","summary":"CGA-33mr-fmvj-9mvc","evidence":"osv:CGA-33mr-fmvj-9mvc","products":[{"name":{"value":"dependency-track","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"dependency-track","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.4-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-33mr-fmvj-9mvc","aliases":["CGA-33mr-fmvj-9mvc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/chainguard/dependency-track?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-33mr-fmvj-9mvc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r1"}]}],"package":{"name":"dependency-track","purl":"pkg:apk/wolfi/dependency-track?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-33mr-fmvj-9mvc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.5","component_type":"java-archive","component_version":"2.21.5","component_location":"/usr/share/java/dependency-track/dependency-track-apiserver.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-09-29T22:46:07Z"}]}}],"modified":"2026-09-30T04:30:21.314791845Z","provider":"osv","references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","https://nvd.nist.gov/vuln/detail/CVE-2026-83557","https://github.com/FasterXML/jackson-databind/issues/6156","https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","https://github.com/FasterXML/jackson-databind/pull/6155","https://github.com/FasterXML/jackson-databind"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6e883124-0b10-4dff-8b59-c273340381f7","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-33mr-fmvj-9mvc","advisory_id":"6e883124-0b10-4dff-8b59-c273340381f7","event_types":["advisory"],"published_at":"2026-10-25T09:09:22.874985+00:00","technologies":["core-osv","dependency-track"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T13:34:03+00:00","detail_url":"/events/33613"}]}}],"next_after":71569,"next_before":33897}