{"schema_version":"2","view":"grouped","data":[{"id":71884,"cve_ids":["CVE-2026-49264"],"payload":{"kind":"advisory","title":"CGA-jhp6-ghcj-27h2","summary":"CGA-jhp6-ghcj-27h2","evidence":"osv:CGA-jhp6-ghcj-27h2","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jhp6-ghcj-27h2","aliases":["CGA-jhp6-ghcj-27h2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jhp6-ghcj-27h2.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:01:36.885265483Z","provider":"osv","upstream":["CVE-2026-49264","GHSA-hj66-6f7g-4r5v"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v","https://github.com/oauthlib/oauthlib/pull/951","https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49264","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:23258bab-a3a0-4652-9623-f8d221fa73c3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49264","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jhp6-ghcj-27h2","advisory_id":"23258bab-a3a0-4652-9623-f8d221fa73c3","event_types":["advisory"],"published_at":"2026-10-25T23:48:15.647232+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/advisories/advisory%3A23258bab-a3a0-4652-9623-f8d221fa73c3","group":{"id":"advisory:23258bab-a3a0-4652-9623-f8d221fa73c3","revision":1,"primary_event_id":72392,"change":"published","superseded_by":[],"changed":{"id":72392,"cve_ids":["CVE-2026-49264"],"payload":{"kind":"advisory","title":"CGA-jhp6-ghcj-27h2","summary":"CGA-jhp6-ghcj-27h2","evidence":"osv:CGA-jhp6-ghcj-27h2","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jhp6-ghcj-27h2","aliases":["CGA-jhp6-ghcj-27h2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jhp6-ghcj-27h2.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:01:36.885265483Z","provider":"osv","upstream":["CVE-2026-49264","GHSA-hj66-6f7g-4r5v"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v","https://github.com/oauthlib/oauthlib/pull/951","https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49264","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:23258bab-a3a0-4652-9623-f8d221fa73c3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49264","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jhp6-ghcj-27h2","advisory_id":"23258bab-a3a0-4652-9623-f8d221fa73c3","event_types":["advisory"],"published_at":"2026-10-25T23:48:15.647232+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/events/72392"},"members":[{"id":72392,"cve_ids":["CVE-2026-49264"],"payload":{"kind":"advisory","title":"CGA-jhp6-ghcj-27h2","summary":"CGA-jhp6-ghcj-27h2","evidence":"osv:CGA-jhp6-ghcj-27h2","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jhp6-ghcj-27h2","aliases":["CGA-jhp6-ghcj-27h2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jhp6-ghcj-27h2.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:01:36.885265483Z","provider":"osv","upstream":["CVE-2026-49264","GHSA-hj66-6f7g-4r5v"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v","https://github.com/oauthlib/oauthlib/pull/951","https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49264","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:23258bab-a3a0-4652-9623-f8d221fa73c3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49264","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jhp6-ghcj-27h2","advisory_id":"23258bab-a3a0-4652-9623-f8d221fa73c3","event_types":["advisory"],"published_at":"2026-10-25T23:48:15.647232+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/events/72392"}]}},{"id":71801,"cve_ids":["CVE-2026-49264"],"payload":{"kind":"advisory","title":"CGA-96w6-rgr3-hhqv","summary":"CGA-96w6-rgr3-hhqv","evidence":"osv:CGA-96w6-rgr3-hhqv","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-96w6-rgr3-hhqv","aliases":["CGA-96w6-rgr3-hhqv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-96w6-rgr3-hhqv.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:07Z"}]}}],"modified":"2026-10-02T23:01:28.673899796Z","provider":"osv","upstream":["CVE-2026-49264","GHSA-hj66-6f7g-4r5v"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v","https://github.com/oauthlib/oauthlib/pull/951","https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49264","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4a43b2a7-1bc1-4845-8a08-a09ce80fa0dd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49264","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-96w6-rgr3-hhqv","advisory_id":"4a43b2a7-1bc1-4845-8a08-a09ce80fa0dd","event_types":["advisory"],"published_at":"2026-10-25T23:39:07.701008+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:40+00:00","detail_url":"/advisories/advisory%3A4a43b2a7-1bc1-4845-8a08-a09ce80fa0dd","group":{"id":"advisory:4a43b2a7-1bc1-4845-8a08-a09ce80fa0dd","revision":1,"primary_event_id":72270,"change":"published","superseded_by":[],"changed":{"id":72270,"cve_ids":["CVE-2026-49264"],"payload":{"kind":"advisory","title":"CGA-96w6-rgr3-hhqv","summary":"CGA-96w6-rgr3-hhqv","evidence":"osv:CGA-96w6-rgr3-hhqv","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-96w6-rgr3-hhqv","aliases":["CGA-96w6-rgr3-hhqv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-96w6-rgr3-hhqv.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:07Z"}]}}],"modified":"2026-10-02T23:01:28.673899796Z","provider":"osv","upstream":["CVE-2026-49264","GHSA-hj66-6f7g-4r5v"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v","https://github.com/oauthlib/oauthlib/pull/951","https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49264","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4a43b2a7-1bc1-4845-8a08-a09ce80fa0dd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49264","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-96w6-rgr3-hhqv","advisory_id":"4a43b2a7-1bc1-4845-8a08-a09ce80fa0dd","event_types":["advisory"],"published_at":"2026-10-25T23:39:07.701008+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:40+00:00","detail_url":"/events/72270"},"members":[{"id":72270,"cve_ids":["CVE-2026-49264"],"payload":{"kind":"advisory","title":"CGA-96w6-rgr3-hhqv","summary":"CGA-96w6-rgr3-hhqv","evidence":"osv:CGA-96w6-rgr3-hhqv","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-96w6-rgr3-hhqv","aliases":["CGA-96w6-rgr3-hhqv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-96w6-rgr3-hhqv.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:07Z"}]}}],"modified":"2026-10-02T23:01:28.673899796Z","provider":"osv","upstream":["CVE-2026-49264","GHSA-hj66-6f7g-4r5v"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v","https://github.com/oauthlib/oauthlib/pull/951","https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49264","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:4a43b2a7-1bc1-4845-8a08-a09ce80fa0dd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49264","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-96w6-rgr3-hhqv","advisory_id":"4a43b2a7-1bc1-4845-8a08-a09ce80fa0dd","event_types":["advisory"],"published_at":"2026-10-25T23:39:07.701008+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:40+00:00","detail_url":"/events/72270"}]}},{"id":71351,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-cp9c-mgch-xrq4","summary":"CGA-cp9c-mgch-xrq4","evidence":"osv:CGA-cp9c-mgch-xrq4","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cp9c-mgch-xrq4","aliases":["CGA-cp9c-mgch-xrq4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cp9c-mgch-xrq4.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:06Z"}]}}],"modified":"2026-10-02T23:00:43.577457181Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7cd21f13-c782-40ff-a0c6-c84540dcd72a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cp9c-mgch-xrq4","advisory_id":"7cd21f13-c782-40ff-a0c6-c84540dcd72a","event_types":["advisory"],"published_at":"2026-10-25T23:04:16.183435+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:40+00:00","detail_url":"/advisories/advisory%3A7cd21f13-c782-40ff-a0c6-c84540dcd72a","group":{"id":"advisory:7cd21f13-c782-40ff-a0c6-c84540dcd72a","revision":1,"primary_event_id":71742,"change":"published","superseded_by":[],"changed":{"id":71742,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-cp9c-mgch-xrq4","summary":"CGA-cp9c-mgch-xrq4","evidence":"osv:CGA-cp9c-mgch-xrq4","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cp9c-mgch-xrq4","aliases":["CGA-cp9c-mgch-xrq4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cp9c-mgch-xrq4.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:06Z"}]}}],"modified":"2026-10-02T23:00:43.577457181Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7cd21f13-c782-40ff-a0c6-c84540dcd72a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cp9c-mgch-xrq4","advisory_id":"7cd21f13-c782-40ff-a0c6-c84540dcd72a","event_types":["advisory"],"published_at":"2026-10-25T23:04:16.183435+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:40+00:00","detail_url":"/events/71742"},"members":[{"id":71742,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-cp9c-mgch-xrq4","summary":"CGA-cp9c-mgch-xrq4","evidence":"osv:CGA-cp9c-mgch-xrq4","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cp9c-mgch-xrq4","aliases":["CGA-cp9c-mgch-xrq4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cp9c-mgch-xrq4.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:06Z"}]}}],"modified":"2026-10-02T23:00:43.577457181Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7cd21f13-c782-40ff-a0c6-c84540dcd72a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cp9c-mgch-xrq4","advisory_id":"7cd21f13-c782-40ff-a0c6-c84540dcd72a","event_types":["advisory"],"published_at":"2026-10-25T23:04:16.183435+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:40+00:00","detail_url":"/events/71742"}]}},{"id":71064,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-w6q5-c9m4-6q56","summary":"CGA-w6q5-c9m4-6q56","evidence":"osv:CGA-w6q5-c9m4-6q56","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w6q5-c9m4-6q56","aliases":["CGA-w6q5-c9m4-6q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q5-c9m4-6q56.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.658924629Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q5-c9m4-6q56","advisory_id":"1138c2e6-508d-4299-8d9f-1b74249e6394","event_types":["advisory"],"published_at":"2026-10-25T22:49:03.318767+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/advisories/advisory%3A1138c2e6-508d-4299-8d9f-1b74249e6394","group":{"id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","revision":1,"primary_event_id":71438,"change":"published","superseded_by":[],"changed":{"id":71438,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-w6q5-c9m4-6q56","summary":"CGA-w6q5-c9m4-6q56","evidence":"osv:CGA-w6q5-c9m4-6q56","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w6q5-c9m4-6q56","aliases":["CGA-w6q5-c9m4-6q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q5-c9m4-6q56.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.658924629Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q5-c9m4-6q56","advisory_id":"1138c2e6-508d-4299-8d9f-1b74249e6394","event_types":["advisory"],"published_at":"2026-10-25T22:49:03.318767+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/events/71438"},"members":[{"id":71438,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-w6q5-c9m4-6q56","summary":"CGA-w6q5-c9m4-6q56","evidence":"osv:CGA-w6q5-c9m4-6q56","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w6q5-c9m4-6q56","aliases":["CGA-w6q5-c9m4-6q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q5-c9m4-6q56.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.658924629Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q5-c9m4-6q56","advisory_id":"1138c2e6-508d-4299-8d9f-1b74249e6394","event_types":["advisory"],"published_at":"2026-10-25T22:49:03.318767+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/events/71438"}]}}],"next_after":71884,"next_before":71064}