{"schema_version":"2","view":"grouped","data":[{"id":72050,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-x848-rhhg-qjm7","summary":"CGA-x848-rhhg-qjm7","evidence":"osv:CGA-x848-rhhg-qjm7","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-x848-rhhg-qjm7","aliases":["CGA-x848-rhhg-qjm7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x848-rhhg-qjm7.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:07Z"}]}}],"modified":"2026-10-02T23:01:55.626689425Z","provider":"osv","upstream":["GHSA-8vvx-rff5-p5rq"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:224ad83d-891b-4533-a415-4f794b403bbb","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x848-rhhg-qjm7","advisory_id":"224ad83d-891b-4533-a415-4f794b403bbb","event_types":["advisory"],"published_at":"2026-10-26T00:13:27.477446+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:54:10+00:00","detail_url":"/advisories/advisory%3A224ad83d-891b-4533-a415-4f794b403bbb","group":{"id":"advisory:224ad83d-891b-4533-a415-4f794b403bbb","revision":1,"primary_event_id":72673,"change":"published","superseded_by":[],"changed":{"id":72673,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-x848-rhhg-qjm7","summary":"CGA-x848-rhhg-qjm7","evidence":"osv:CGA-x848-rhhg-qjm7","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-x848-rhhg-qjm7","aliases":["CGA-x848-rhhg-qjm7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x848-rhhg-qjm7.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:07Z"}]}}],"modified":"2026-10-02T23:01:55.626689425Z","provider":"osv","upstream":["GHSA-8vvx-rff5-p5rq"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:224ad83d-891b-4533-a415-4f794b403bbb","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x848-rhhg-qjm7","advisory_id":"224ad83d-891b-4533-a415-4f794b403bbb","event_types":["advisory"],"published_at":"2026-10-26T00:13:27.477446+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:54:10+00:00","detail_url":"/events/72673"},"members":[{"id":72673,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-x848-rhhg-qjm7","summary":"CGA-x848-rhhg-qjm7","evidence":"osv:CGA-x848-rhhg-qjm7","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-x848-rhhg-qjm7","aliases":["CGA-x848-rhhg-qjm7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x848-rhhg-qjm7.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:07Z"}]}}],"modified":"2026-10-02T23:01:55.626689425Z","provider":"osv","upstream":["GHSA-8vvx-rff5-p5rq"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:224ad83d-891b-4533-a415-4f794b403bbb","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x848-rhhg-qjm7","advisory_id":"224ad83d-891b-4533-a415-4f794b403bbb","event_types":["advisory"],"published_at":"2026-10-26T00:13:27.477446+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:54:10+00:00","detail_url":"/events/72673"}]}},{"id":71901,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m93w-5pwg-p7f2","summary":"CGA-m93w-5pwg-p7f2","evidence":"osv:CGA-m93w-5pwg-p7f2","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m93w-5pwg-p7f2","aliases":["CGA-m93w-5pwg-p7f2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m93w-5pwg-p7f2.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:39Z"}]}}],"modified":"2026-10-02T23:01:39.544669063Z","provider":"osv","upstream":["GHSA-6vj9-mwq6-2f5v"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9cdf1b65-f5c1-46ef-906f-830c77f8372e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m93w-5pwg-p7f2","advisory_id":"9cdf1b65-f5c1-46ef-906f-830c77f8372e","event_types":["advisory"],"published_at":"2026-10-25T23:49:35.143058+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:25:54+00:00","detail_url":"/advisories/advisory%3A9cdf1b65-f5c1-46ef-906f-830c77f8372e","group":{"id":"advisory:9cdf1b65-f5c1-46ef-906f-830c77f8372e","revision":1,"primary_event_id":72417,"change":"published","superseded_by":[],"changed":{"id":72417,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m93w-5pwg-p7f2","summary":"CGA-m93w-5pwg-p7f2","evidence":"osv:CGA-m93w-5pwg-p7f2","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m93w-5pwg-p7f2","aliases":["CGA-m93w-5pwg-p7f2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m93w-5pwg-p7f2.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:39Z"}]}}],"modified":"2026-10-02T23:01:39.544669063Z","provider":"osv","upstream":["GHSA-6vj9-mwq6-2f5v"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9cdf1b65-f5c1-46ef-906f-830c77f8372e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m93w-5pwg-p7f2","advisory_id":"9cdf1b65-f5c1-46ef-906f-830c77f8372e","event_types":["advisory"],"published_at":"2026-10-25T23:49:35.143058+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:25:54+00:00","detail_url":"/events/72417"},"members":[{"id":72417,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m93w-5pwg-p7f2","summary":"CGA-m93w-5pwg-p7f2","evidence":"osv:CGA-m93w-5pwg-p7f2","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m93w-5pwg-p7f2","aliases":["CGA-m93w-5pwg-p7f2"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m93w-5pwg-p7f2.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:39Z"}]}}],"modified":"2026-10-02T23:01:39.544669063Z","provider":"osv","upstream":["GHSA-6vj9-mwq6-2f5v"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:9cdf1b65-f5c1-46ef-906f-830c77f8372e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m93w-5pwg-p7f2","advisory_id":"9cdf1b65-f5c1-46ef-906f-830c77f8372e","event_types":["advisory"],"published_at":"2026-10-25T23:49:35.143058+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T12:25:54+00:00","detail_url":"/events/72417"}]}},{"id":71897,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p2c7-7w8x-9fjx","summary":"CGA-p2c7-7w8x-9fjx","evidence":"osv:CGA-p2c7-7w8x-9fjx","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-p2c7-7w8x-9fjx","aliases":["CGA-p2c7-7w8x-9fjx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p2c7-7w8x-9fjx.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:07Z"}]}}],"modified":"2026-10-02T23:01:38.592760027Z","provider":"osv","upstream":["GHSA-6vj9-mwq6-2f5v"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e6fdf89a-3a3b-4a9d-9e35-0b3c8d9c602a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p2c7-7w8x-9fjx","advisory_id":"e6fdf89a-3a3b-4a9d-9e35-0b3c8d9c602a","event_types":["advisory"],"published_at":"2026-10-25T23:49:22.374532+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:01:05+00:00","detail_url":"/advisories/advisory%3Ae6fdf89a-3a3b-4a9d-9e35-0b3c8d9c602a","group":{"id":"advisory:e6fdf89a-3a3b-4a9d-9e35-0b3c8d9c602a","revision":1,"primary_event_id":72413,"change":"published","superseded_by":[],"changed":{"id":72413,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p2c7-7w8x-9fjx","summary":"CGA-p2c7-7w8x-9fjx","evidence":"osv:CGA-p2c7-7w8x-9fjx","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-p2c7-7w8x-9fjx","aliases":["CGA-p2c7-7w8x-9fjx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p2c7-7w8x-9fjx.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:07Z"}]}}],"modified":"2026-10-02T23:01:38.592760027Z","provider":"osv","upstream":["GHSA-6vj9-mwq6-2f5v"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e6fdf89a-3a3b-4a9d-9e35-0b3c8d9c602a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p2c7-7w8x-9fjx","advisory_id":"e6fdf89a-3a3b-4a9d-9e35-0b3c8d9c602a","event_types":["advisory"],"published_at":"2026-10-25T23:49:22.374532+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:01:05+00:00","detail_url":"/events/72413"},"members":[{"id":72413,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p2c7-7w8x-9fjx","summary":"CGA-p2c7-7w8x-9fjx","evidence":"osv:CGA-p2c7-7w8x-9fjx","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-p2c7-7w8x-9fjx","aliases":["CGA-p2c7-7w8x-9fjx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p2c7-7w8x-9fjx.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:07Z"}]}}],"modified":"2026-10-02T23:01:38.592760027Z","provider":"osv","upstream":["GHSA-6vj9-mwq6-2f5v"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e6fdf89a-3a3b-4a9d-9e35-0b3c8d9c602a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p2c7-7w8x-9fjx","advisory_id":"e6fdf89a-3a3b-4a9d-9e35-0b3c8d9c602a","event_types":["advisory"],"published_at":"2026-10-25T23:49:22.374532+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T14:01:05+00:00","detail_url":"/events/72413"}]}},{"id":71791,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7q22-85cg-rjpr","summary":"CGA-7q22-85cg-rjpr","evidence":"osv:CGA-7q22-85cg-rjpr","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7q22-85cg-rjpr","aliases":["CGA-7q22-85cg-rjpr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7q22-85cg-rjpr.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:39Z"}]}}],"modified":"2026-10-02T23:01:27.957980661Z","provider":"osv","upstream":["GHSA-g57g-f23g-4646"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a75cadaa-ba4d-4d95-8730-9aef1505228c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7q22-85cg-rjpr","advisory_id":"a75cadaa-ba4d-4d95-8730-9aef1505228c","event_types":["advisory"],"published_at":"2026-10-25T23:38:37.336233+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:48+00:00","detail_url":"/advisories/advisory%3Aa75cadaa-ba4d-4d95-8730-9aef1505228c","group":{"id":"advisory:a75cadaa-ba4d-4d95-8730-9aef1505228c","revision":1,"primary_event_id":72260,"change":"published","superseded_by":[],"changed":{"id":72260,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7q22-85cg-rjpr","summary":"CGA-7q22-85cg-rjpr","evidence":"osv:CGA-7q22-85cg-rjpr","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7q22-85cg-rjpr","aliases":["CGA-7q22-85cg-rjpr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7q22-85cg-rjpr.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:39Z"}]}}],"modified":"2026-10-02T23:01:27.957980661Z","provider":"osv","upstream":["GHSA-g57g-f23g-4646"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a75cadaa-ba4d-4d95-8730-9aef1505228c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7q22-85cg-rjpr","advisory_id":"a75cadaa-ba4d-4d95-8730-9aef1505228c","event_types":["advisory"],"published_at":"2026-10-25T23:38:37.336233+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:48+00:00","detail_url":"/events/72260"},"members":[{"id":72260,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7q22-85cg-rjpr","summary":"CGA-7q22-85cg-rjpr","evidence":"osv:CGA-7q22-85cg-rjpr","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7q22-85cg-rjpr","aliases":["CGA-7q22-85cg-rjpr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7q22-85cg-rjpr.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:39Z"}]}}],"modified":"2026-10-02T23:01:27.957980661Z","provider":"osv","upstream":["GHSA-g57g-f23g-4646"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a75cadaa-ba4d-4d95-8730-9aef1505228c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7q22-85cg-rjpr","advisory_id":"a75cadaa-ba4d-4d95-8730-9aef1505228c","event_types":["advisory"],"published_at":"2026-10-25T23:38:37.336233+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:48+00:00","detail_url":"/events/72260"}]}},{"id":71718,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-f3v9-2f55-q63f","summary":"CGA-f3v9-2f55-q63f","evidence":"osv:CGA-f3v9-2f55-q63f","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f3v9-2f55-q63f","aliases":["CGA-f3v9-2f55-q63f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f3v9-2f55-q63f.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:40Z"}]}}],"modified":"2026-10-02T23:01:20.379479395Z","provider":"osv","upstream":["GHSA-v53p-9fqp-m79j"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a9baa6a5-2c61-49d1-8e09-447b37a99cf4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f3v9-2f55-q63f","advisory_id":"a9baa6a5-2c61-49d1-8e09-447b37a99cf4","event_types":["advisory"],"published_at":"2026-10-25T23:31:47.255946+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:49+00:00","detail_url":"/advisories/advisory%3Aa9baa6a5-2c61-49d1-8e09-447b37a99cf4","group":{"id":"advisory:a9baa6a5-2c61-49d1-8e09-447b37a99cf4","revision":1,"primary_event_id":72162,"change":"published","superseded_by":[],"changed":{"id":72162,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-f3v9-2f55-q63f","summary":"CGA-f3v9-2f55-q63f","evidence":"osv:CGA-f3v9-2f55-q63f","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f3v9-2f55-q63f","aliases":["CGA-f3v9-2f55-q63f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f3v9-2f55-q63f.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:40Z"}]}}],"modified":"2026-10-02T23:01:20.379479395Z","provider":"osv","upstream":["GHSA-v53p-9fqp-m79j"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a9baa6a5-2c61-49d1-8e09-447b37a99cf4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f3v9-2f55-q63f","advisory_id":"a9baa6a5-2c61-49d1-8e09-447b37a99cf4","event_types":["advisory"],"published_at":"2026-10-25T23:31:47.255946+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:49+00:00","detail_url":"/events/72162"},"members":[{"id":72162,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-f3v9-2f55-q63f","summary":"CGA-f3v9-2f55-q63f","evidence":"osv:CGA-f3v9-2f55-q63f","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-f3v9-2f55-q63f","aliases":["CGA-f3v9-2f55-q63f"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f3v9-2f55-q63f.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:40Z"}]}}],"modified":"2026-10-02T23:01:20.379479395Z","provider":"osv","upstream":["GHSA-v53p-9fqp-m79j"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a9baa6a5-2c61-49d1-8e09-447b37a99cf4","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f3v9-2f55-q63f","advisory_id":"a9baa6a5-2c61-49d1-8e09-447b37a99cf4","event_types":["advisory"],"published_at":"2026-10-25T23:31:47.255946+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:49+00:00","detail_url":"/events/72162"}]}},{"id":71410,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-gfmj-qcvm-fm92","summary":"CGA-gfmj-qcvm-fm92","evidence":"osv:CGA-gfmj-qcvm-fm92","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gfmj-qcvm-fm92","aliases":["CGA-gfmj-qcvm-fm92"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gfmj-qcvm-fm92.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:06Z"}]}}],"modified":"2026-10-02T23:00:49.072968984Z","provider":"osv","upstream":["GHSA-v53p-9fqp-m79j"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3e1945e3-9746-4bea-95bd-58f66dade878","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gfmj-qcvm-fm92","advisory_id":"3e1945e3-9746-4bea-95bd-58f66dade878","event_types":["advisory"],"published_at":"2026-10-25T23:08:12.649475+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:54:11+00:00","detail_url":"/advisories/advisory%3A3e1945e3-9746-4bea-95bd-58f66dade878","group":{"id":"advisory:3e1945e3-9746-4bea-95bd-58f66dade878","revision":1,"primary_event_id":71801,"change":"published","superseded_by":[],"changed":{"id":71801,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-gfmj-qcvm-fm92","summary":"CGA-gfmj-qcvm-fm92","evidence":"osv:CGA-gfmj-qcvm-fm92","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gfmj-qcvm-fm92","aliases":["CGA-gfmj-qcvm-fm92"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gfmj-qcvm-fm92.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:06Z"}]}}],"modified":"2026-10-02T23:00:49.072968984Z","provider":"osv","upstream":["GHSA-v53p-9fqp-m79j"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3e1945e3-9746-4bea-95bd-58f66dade878","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gfmj-qcvm-fm92","advisory_id":"3e1945e3-9746-4bea-95bd-58f66dade878","event_types":["advisory"],"published_at":"2026-10-25T23:08:12.649475+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:54:11+00:00","detail_url":"/events/71801"},"members":[{"id":71801,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-gfmj-qcvm-fm92","summary":"CGA-gfmj-qcvm-fm92","evidence":"osv:CGA-gfmj-qcvm-fm92","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gfmj-qcvm-fm92","aliases":["CGA-gfmj-qcvm-fm92"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gfmj-qcvm-fm92.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:06Z"}]}}],"modified":"2026-10-02T23:00:49.072968984Z","provider":"osv","upstream":["GHSA-v53p-9fqp-m79j"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:3e1945e3-9746-4bea-95bd-58f66dade878","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gfmj-qcvm-fm92","advisory_id":"3e1945e3-9746-4bea-95bd-58f66dade878","event_types":["advisory"],"published_at":"2026-10-25T23:08:12.649475+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:54:11+00:00","detail_url":"/events/71801"}]}},{"id":71387,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-fjw5-6p9r-jrc6","summary":"CGA-fjw5-6p9r-jrc6","evidence":"osv:CGA-fjw5-6p9r-jrc6","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fjw5-6p9r-jrc6","aliases":["CGA-fjw5-6p9r-jrc6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjw5-6p9r-jrc6.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:39Z"}]}}],"modified":"2026-10-02T23:00:47.609603845Z","provider":"osv","upstream":["GHSA-8vvx-rff5-p5rq"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:30ad8b5d-fc7b-44b1-ae01-7abbb74aadb5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fjw5-6p9r-jrc6","advisory_id":"30ad8b5d-fc7b-44b1-ae01-7abbb74aadb5","event_types":["advisory"],"published_at":"2026-10-25T23:07:26.990033+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:48+00:00","detail_url":"/advisories/advisory%3A30ad8b5d-fc7b-44b1-ae01-7abbb74aadb5","group":{"id":"advisory:30ad8b5d-fc7b-44b1-ae01-7abbb74aadb5","revision":1,"primary_event_id":71778,"change":"published","superseded_by":[],"changed":{"id":71778,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-fjw5-6p9r-jrc6","summary":"CGA-fjw5-6p9r-jrc6","evidence":"osv:CGA-fjw5-6p9r-jrc6","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fjw5-6p9r-jrc6","aliases":["CGA-fjw5-6p9r-jrc6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjw5-6p9r-jrc6.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:39Z"}]}}],"modified":"2026-10-02T23:00:47.609603845Z","provider":"osv","upstream":["GHSA-8vvx-rff5-p5rq"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:30ad8b5d-fc7b-44b1-ae01-7abbb74aadb5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fjw5-6p9r-jrc6","advisory_id":"30ad8b5d-fc7b-44b1-ae01-7abbb74aadb5","event_types":["advisory"],"published_at":"2026-10-25T23:07:26.990033+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:48+00:00","detail_url":"/events/71778"},"members":[{"id":71778,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-fjw5-6p9r-jrc6","summary":"CGA-fjw5-6p9r-jrc6","evidence":"osv:CGA-fjw5-6p9r-jrc6","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fjw5-6p9r-jrc6","aliases":["CGA-fjw5-6p9r-jrc6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjw5-6p9r-jrc6.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:04:39Z"}]}}],"modified":"2026-10-02T23:00:47.609603845Z","provider":"osv","upstream":["GHSA-8vvx-rff5-p5rq"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:30ad8b5d-fc7b-44b1-ae01-7abbb74aadb5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fjw5-6p9r-jrc6","advisory_id":"30ad8b5d-fc7b-44b1-ae01-7abbb74aadb5","event_types":["advisory"],"published_at":"2026-10-25T23:07:26.990033+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:48+00:00","detail_url":"/events/71778"}]}},{"id":71019,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-45jq-jrr7-4p5v","summary":"CGA-45jq-jrr7-4p5v","evidence":"osv:CGA-45jq-jrr7-4p5v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-45jq-jrr7-4p5v","aliases":["CGA-45jq-jrr7-4p5v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-45jq-jrr7-4p5v.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:06Z"}]}}],"modified":"2026-10-02T23:00:06.966475197Z","provider":"osv","upstream":["GHSA-g57g-f23g-4646"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7d2d3350-6d61-4cf5-84ba-0ef3b685f0dc","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-45jq-jrr7-4p5v","advisory_id":"7d2d3350-6d61-4cf5-84ba-0ef3b685f0dc","event_types":["advisory"],"published_at":"2026-10-25T22:47:14.256261+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:54:10+00:00","detail_url":"/advisories/advisory%3A7d2d3350-6d61-4cf5-84ba-0ef3b685f0dc","group":{"id":"advisory:7d2d3350-6d61-4cf5-84ba-0ef3b685f0dc","revision":1,"primary_event_id":71393,"change":"published","superseded_by":[],"changed":{"id":71393,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-45jq-jrr7-4p5v","summary":"CGA-45jq-jrr7-4p5v","evidence":"osv:CGA-45jq-jrr7-4p5v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-45jq-jrr7-4p5v","aliases":["CGA-45jq-jrr7-4p5v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-45jq-jrr7-4p5v.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:06Z"}]}}],"modified":"2026-10-02T23:00:06.966475197Z","provider":"osv","upstream":["GHSA-g57g-f23g-4646"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7d2d3350-6d61-4cf5-84ba-0ef3b685f0dc","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-45jq-jrr7-4p5v","advisory_id":"7d2d3350-6d61-4cf5-84ba-0ef3b685f0dc","event_types":["advisory"],"published_at":"2026-10-25T22:47:14.256261+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:54:10+00:00","detail_url":"/events/71393"},"members":[{"id":71393,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-45jq-jrr7-4p5v","summary":"CGA-45jq-jrr7-4p5v","evidence":"osv:CGA-45jq-jrr7-4p5v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.50.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-45jq-jrr7-4p5v","aliases":["CGA-45jq-jrr7-4p5v"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-r1"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-45jq-jrr7-4p5v.json"},"ecosystem_specific":{"components":[{"component_name":"nodemailer","component_purl":"pkg:npm/nodemailer@9.1.1","component_type":"npm","component_version":"9.1.1","component_location":"/app/node_modules/.pnpm/nodemailer@9.1.1/node_modules/nodemailer/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:22:06Z"}]}}],"modified":"2026-10-02T23:00:06.966475197Z","provider":"osv","upstream":["GHSA-g57g-f23g-4646"],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7d2d3350-6d61-4cf5-84ba-0ef3b685f0dc","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-45jq-jrr7-4p5v","advisory_id":"7d2d3350-6d61-4cf5-84ba-0ef3b685f0dc","event_types":["advisory"],"published_at":"2026-10-25T22:47:14.256261+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:54:10+00:00","detail_url":"/events/71393"}]}},{"id":70772,"cve_ids":["CVE-2026-101909"],"payload":{"kind":"advisory","title":"CGA-rrmg-24jq-p9hx","summary":"CGA-rrmg-24jq-p9hx","evidence":"osv:CGA-rrmg-24jq-p9hx","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rrmg-24jq-p9hx","aliases":["CGA-rrmg-24jq-p9hx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rrmg-24jq-p9hx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-02T18:25:45.321167057Z","provider":"osv","upstream":["CVE-2026-101909","GHSA-x97p-jq2g-jp4f"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101909.json","https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f","https://nvd.nist.gov/vuln/detail/CVE-2026-101909","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101909","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:cc89a114-3f35-4e38-ba61-b099893e73ed","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101909","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101909","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101909","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.34.0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"axios","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-x97p-jq2g-jp4f","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rrmg-24jq-p9hx","advisory_id":"cc89a114-3f35-4e38-ba61-b099893e73ed","event_types":["advisory"],"published_at":"2026-10-25T22:38:47.144693+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:21+00:00","detail_url":"/advisories/advisory%3Acc89a114-3f35-4e38-ba61-b099893e73ed","group":{"id":"advisory:cc89a114-3f35-4e38-ba61-b099893e73ed","revision":1,"primary_event_id":71143,"change":"published","superseded_by":[],"changed":{"id":71143,"cve_ids":["CVE-2026-101909"],"payload":{"kind":"advisory","title":"CGA-rrmg-24jq-p9hx","summary":"CGA-rrmg-24jq-p9hx","evidence":"osv:CGA-rrmg-24jq-p9hx","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rrmg-24jq-p9hx","aliases":["CGA-rrmg-24jq-p9hx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rrmg-24jq-p9hx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-02T18:25:45.321167057Z","provider":"osv","upstream":["CVE-2026-101909","GHSA-x97p-jq2g-jp4f"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101909.json","https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f","https://nvd.nist.gov/vuln/detail/CVE-2026-101909","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101909","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:cc89a114-3f35-4e38-ba61-b099893e73ed","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101909","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101909","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101909","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.34.0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"axios","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-x97p-jq2g-jp4f","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rrmg-24jq-p9hx","advisory_id":"cc89a114-3f35-4e38-ba61-b099893e73ed","event_types":["advisory"],"published_at":"2026-10-25T22:38:47.144693+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:21+00:00","detail_url":"/events/71143"},"members":[{"id":71143,"cve_ids":["CVE-2026-101909"],"payload":{"kind":"advisory","title":"CGA-rrmg-24jq-p9hx","summary":"CGA-rrmg-24jq-p9hx","evidence":"osv:CGA-rrmg-24jq-p9hx","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rrmg-24jq-p9hx","aliases":["CGA-rrmg-24jq-p9hx"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rrmg-24jq-p9hx.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-02T18:25:45.321167057Z","provider":"osv","upstream":["CVE-2026-101909","GHSA-x97p-jq2g-jp4f"],"references":["https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101909.json","https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f","https://nvd.nist.gov/vuln/detail/CVE-2026-101909","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101909","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:cc89a114-3f35-4e38-ba61-b099893e73ed","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101909","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101909","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101909","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.34.0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"axios","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-x97p-jq2g-jp4f","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rrmg-24jq-p9hx","advisory_id":"cc89a114-3f35-4e38-ba61-b099893e73ed","event_types":["advisory"],"published_at":"2026-10-25T22:38:47.144693+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:21+00:00","detail_url":"/events/71143"}]}},{"id":70597,"cve_ids":["CVE-2026-101904"],"payload":{"kind":"advisory","title":"CGA-xff5-2xjx-6vph","summary":"CGA-xff5-2xjx-6vph","evidence":"osv:CGA-xff5-2xjx-6vph","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xff5-2xjx-6vph","aliases":["CGA-xff5-2xjx-6vph"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xff5-2xjx-6vph.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-02T18:25:36.427154802Z","provider":"osv","upstream":["CVE-2026-101904","GHSA-j8rh-479h-cp32"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101904.json","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101904","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:78f27206-60c9-42b0-be2a-fc361636aafc","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101904","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101904","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xff5-2xjx-6vph","advisory_id":"78f27206-60c9-42b0-be2a-fc361636aafc","event_types":["advisory"],"published_at":"2026-10-25T22:31:11.538874+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/advisories/advisory%3A78f27206-60c9-42b0-be2a-fc361636aafc","group":{"id":"advisory:78f27206-60c9-42b0-be2a-fc361636aafc","revision":1,"primary_event_id":70967,"change":"published","superseded_by":[],"changed":{"id":70967,"cve_ids":["CVE-2026-101904"],"payload":{"kind":"advisory","title":"CGA-xff5-2xjx-6vph","summary":"CGA-xff5-2xjx-6vph","evidence":"osv:CGA-xff5-2xjx-6vph","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xff5-2xjx-6vph","aliases":["CGA-xff5-2xjx-6vph"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xff5-2xjx-6vph.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-02T18:25:36.427154802Z","provider":"osv","upstream":["CVE-2026-101904","GHSA-j8rh-479h-cp32"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101904.json","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101904","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:78f27206-60c9-42b0-be2a-fc361636aafc","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101904","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101904","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xff5-2xjx-6vph","advisory_id":"78f27206-60c9-42b0-be2a-fc361636aafc","event_types":["advisory"],"published_at":"2026-10-25T22:31:11.538874+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/events/70967"},"members":[{"id":70967,"cve_ids":["CVE-2026-101904"],"payload":{"kind":"advisory","title":"CGA-xff5-2xjx-6vph","summary":"CGA-xff5-2xjx-6vph","evidence":"osv:CGA-xff5-2xjx-6vph","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xff5-2xjx-6vph","aliases":["CGA-xff5-2xjx-6vph"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xff5-2xjx-6vph.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-02T18:25:36.427154802Z","provider":"osv","upstream":["CVE-2026-101904","GHSA-j8rh-479h-cp32"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101904.json","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101904","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:78f27206-60c9-42b0-be2a-fc361636aafc","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-101904","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101904","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xff5-2xjx-6vph","advisory_id":"78f27206-60c9-42b0-be2a-fc361636aafc","event_types":["advisory"],"published_at":"2026-10-25T22:31:11.538874+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/events/70967"}]}},{"id":70575,"cve_ids":["CVE-2026-101901"],"payload":{"kind":"advisory","title":"CGA-gmrw-fgg5-jr73","summary":"CGA-gmrw-fgg5-jr73","evidence":"osv:CGA-gmrw-fgg5-jr73","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gmrw-fgg5-jr73","aliases":["CGA-gmrw-fgg5-jr73"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gmrw-fgg5-jr73.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-02T18:25:35.497620247Z","provider":"osv","upstream":["CVE-2026-101901","GHSA-542g-h47m-68v8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101901.json","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101901","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5a46aeb2-e89c-4d41-a8b2-dd50974a9370","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gmrw-fgg5-jr73","advisory_id":"5a46aeb2-e89c-4d41-a8b2-dd50974a9370","event_types":["advisory"],"published_at":"2026-10-25T22:29:58.257132+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:19+00:00","detail_url":"/advisories/advisory%3A5a46aeb2-e89c-4d41-a8b2-dd50974a9370","group":{"id":"advisory:5a46aeb2-e89c-4d41-a8b2-dd50974a9370","revision":1,"primary_event_id":70945,"change":"published","superseded_by":[],"changed":{"id":70945,"cve_ids":["CVE-2026-101901"],"payload":{"kind":"advisory","title":"CGA-gmrw-fgg5-jr73","summary":"CGA-gmrw-fgg5-jr73","evidence":"osv:CGA-gmrw-fgg5-jr73","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gmrw-fgg5-jr73","aliases":["CGA-gmrw-fgg5-jr73"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gmrw-fgg5-jr73.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-02T18:25:35.497620247Z","provider":"osv","upstream":["CVE-2026-101901","GHSA-542g-h47m-68v8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101901.json","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101901","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5a46aeb2-e89c-4d41-a8b2-dd50974a9370","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gmrw-fgg5-jr73","advisory_id":"5a46aeb2-e89c-4d41-a8b2-dd50974a9370","event_types":["advisory"],"published_at":"2026-10-25T22:29:58.257132+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:19+00:00","detail_url":"/events/70945"},"members":[{"id":70945,"cve_ids":["CVE-2026-101901"],"payload":{"kind":"advisory","title":"CGA-gmrw-fgg5-jr73","summary":"CGA-gmrw-fgg5-jr73","evidence":"osv:CGA-gmrw-fgg5-jr73","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-gmrw-fgg5-jr73","aliases":["CGA-gmrw-fgg5-jr73"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-gmrw-fgg5-jr73.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-02T18:25:35.497620247Z","provider":"osv","upstream":["CVE-2026-101901","GHSA-542g-h47m-68v8"],"references":["https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101901.json","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141"]},"related_cves":[{"value":"CVE-2026-101901","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:5a46aeb2-e89c-4d41-a8b2-dd50974a9370","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-101901","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"axios","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-101901","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"axios","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.20.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-542g-h47m-68v8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-gmrw-fgg5-jr73","advisory_id":"5a46aeb2-e89c-4d41-a8b2-dd50974a9370","event_types":["advisory"],"published_at":"2026-10-25T22:29:58.257132+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:19+00:00","detail_url":"/events/70945"}]}},{"id":65822,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-wcvc-r3c6-3655","summary":"CGA-wcvc-r3c6-3655","evidence":"osv:CGA-wcvc-r3c6-3655","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wcvc-r3c6-3655","aliases":["CGA-wcvc-r3c6-3655"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wcvc-r3c6-3655.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:15Z"}]}}],"modified":"2026-10-01T23:02:59.239514409Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2da0f422-7d43-4a7c-9f96-ab07e9db157e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wcvc-r3c6-3655","advisory_id":"2da0f422-7d43-4a7c-9f96-ab07e9db157e","event_types":["advisory"],"published_at":"2026-10-25T20:29:47.700866+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:14+00:00","detail_url":"/advisories/advisory%3A2da0f422-7d43-4a7c-9f96-ab07e9db157e","group":{"id":"advisory:2da0f422-7d43-4a7c-9f96-ab07e9db157e","revision":1,"primary_event_id":65134,"change":"published","superseded_by":[],"changed":{"id":65134,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-wcvc-r3c6-3655","summary":"CGA-wcvc-r3c6-3655","evidence":"osv:CGA-wcvc-r3c6-3655","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wcvc-r3c6-3655","aliases":["CGA-wcvc-r3c6-3655"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wcvc-r3c6-3655.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:15Z"}]}}],"modified":"2026-10-01T23:02:59.239514409Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2da0f422-7d43-4a7c-9f96-ab07e9db157e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wcvc-r3c6-3655","advisory_id":"2da0f422-7d43-4a7c-9f96-ab07e9db157e","event_types":["advisory"],"published_at":"2026-10-25T20:29:47.700866+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:14+00:00","detail_url":"/events/65134"},"members":[{"id":65134,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-wcvc-r3c6-3655","summary":"CGA-wcvc-r3c6-3655","evidence":"osv:CGA-wcvc-r3c6-3655","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-wcvc-r3c6-3655","aliases":["CGA-wcvc-r3c6-3655"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wcvc-r3c6-3655.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:15Z"}]}}],"modified":"2026-10-01T23:02:59.239514409Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2da0f422-7d43-4a7c-9f96-ab07e9db157e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wcvc-r3c6-3655","advisory_id":"2da0f422-7d43-4a7c-9f96-ab07e9db157e","event_types":["advisory"],"published_at":"2026-10-25T20:29:47.700866+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:14+00:00","detail_url":"/events/65134"}]}},{"id":65811,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-w4p4-j5pv-q49j","summary":"CGA-w4p4-j5pv-q49j","evidence":"osv:CGA-w4p4-j5pv-q49j","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w4p4-j5pv-q49j","aliases":["CGA-w4p4-j5pv-q49j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w4p4-j5pv-q49j.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:18Z"}]}}],"modified":"2026-10-01T23:02:57.330982466Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8fbfeb0d-b188-4bb6-82ff-0fbe19d84117","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w4p4-j5pv-q49j","advisory_id":"8fbfeb0d-b188-4bb6-82ff-0fbe19d84117","event_types":["advisory"],"published_at":"2026-10-25T20:29:39.460056+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:16+00:00","detail_url":"/advisories/advisory%3A8fbfeb0d-b188-4bb6-82ff-0fbe19d84117","group":{"id":"advisory:8fbfeb0d-b188-4bb6-82ff-0fbe19d84117","revision":1,"primary_event_id":65123,"change":"published","superseded_by":[],"changed":{"id":65123,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-w4p4-j5pv-q49j","summary":"CGA-w4p4-j5pv-q49j","evidence":"osv:CGA-w4p4-j5pv-q49j","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w4p4-j5pv-q49j","aliases":["CGA-w4p4-j5pv-q49j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w4p4-j5pv-q49j.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:18Z"}]}}],"modified":"2026-10-01T23:02:57.330982466Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8fbfeb0d-b188-4bb6-82ff-0fbe19d84117","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w4p4-j5pv-q49j","advisory_id":"8fbfeb0d-b188-4bb6-82ff-0fbe19d84117","event_types":["advisory"],"published_at":"2026-10-25T20:29:39.460056+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:16+00:00","detail_url":"/events/65123"},"members":[{"id":65123,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-w4p4-j5pv-q49j","summary":"CGA-w4p4-j5pv-q49j","evidence":"osv:CGA-w4p4-j5pv-q49j","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-w4p4-j5pv-q49j","aliases":["CGA-w4p4-j5pv-q49j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w4p4-j5pv-q49j.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:18Z"}]}}],"modified":"2026-10-01T23:02:57.330982466Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8fbfeb0d-b188-4bb6-82ff-0fbe19d84117","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w4p4-j5pv-q49j","advisory_id":"8fbfeb0d-b188-4bb6-82ff-0fbe19d84117","event_types":["advisory"],"published_at":"2026-10-25T20:29:39.460056+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:16+00:00","detail_url":"/events/65123"}]}},{"id":65756,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-x9v7-8wf2-j7x8","summary":"CGA-x9v7-8wf2-j7x8","evidence":"osv:CGA-x9v7-8wf2-j7x8","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x9v7-8wf2-j7x8","aliases":["CGA-x9v7-8wf2-j7x8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x9v7-8wf2-j7x8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:17Z"}]}}],"modified":"2026-10-01T23:02:51.632917588Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:21e285e7-f318-4b28-84de-29330707cf44","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x9v7-8wf2-j7x8","advisory_id":"21e285e7-f318-4b28-84de-29330707cf44","event_types":["advisory"],"published_at":"2026-10-25T20:28:57.709704+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:12+00:00","detail_url":"/advisories/advisory%3A21e285e7-f318-4b28-84de-29330707cf44","group":{"id":"advisory:21e285e7-f318-4b28-84de-29330707cf44","revision":1,"primary_event_id":65068,"change":"published","superseded_by":[],"changed":{"id":65068,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-x9v7-8wf2-j7x8","summary":"CGA-x9v7-8wf2-j7x8","evidence":"osv:CGA-x9v7-8wf2-j7x8","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x9v7-8wf2-j7x8","aliases":["CGA-x9v7-8wf2-j7x8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x9v7-8wf2-j7x8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:17Z"}]}}],"modified":"2026-10-01T23:02:51.632917588Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:21e285e7-f318-4b28-84de-29330707cf44","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x9v7-8wf2-j7x8","advisory_id":"21e285e7-f318-4b28-84de-29330707cf44","event_types":["advisory"],"published_at":"2026-10-25T20:28:57.709704+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:12+00:00","detail_url":"/events/65068"},"members":[{"id":65068,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-x9v7-8wf2-j7x8","summary":"CGA-x9v7-8wf2-j7x8","evidence":"osv:CGA-x9v7-8wf2-j7x8","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x9v7-8wf2-j7x8","aliases":["CGA-x9v7-8wf2-j7x8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x9v7-8wf2-j7x8.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:17Z"}]}}],"modified":"2026-10-01T23:02:51.632917588Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:21e285e7-f318-4b28-84de-29330707cf44","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x9v7-8wf2-j7x8","advisory_id":"21e285e7-f318-4b28-84de-29330707cf44","event_types":["advisory"],"published_at":"2026-10-25T20:28:57.709704+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:12+00:00","detail_url":"/events/65068"}]}},{"id":65730,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-rv3r-pq87-c5w5","summary":"CGA-rv3r-pq87-c5w5","evidence":"osv:CGA-rv3r-pq87-c5w5","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rv3r-pq87-c5w5","aliases":["CGA-rv3r-pq87-c5w5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rv3r-pq87-c5w5.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:02:48.326394787Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9b43aed5-f3c3-4d2d-b795-3eb1ac2cafdb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rv3r-pq87-c5w5","advisory_id":"9b43aed5-f3c3-4d2d-b795-3eb1ac2cafdb","event_types":["advisory"],"published_at":"2026-10-25T20:28:37.112653+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:19+00:00","detail_url":"/advisories/advisory%3A9b43aed5-f3c3-4d2d-b795-3eb1ac2cafdb","group":{"id":"advisory:9b43aed5-f3c3-4d2d-b795-3eb1ac2cafdb","revision":1,"primary_event_id":65042,"change":"published","superseded_by":[],"changed":{"id":65042,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-rv3r-pq87-c5w5","summary":"CGA-rv3r-pq87-c5w5","evidence":"osv:CGA-rv3r-pq87-c5w5","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rv3r-pq87-c5w5","aliases":["CGA-rv3r-pq87-c5w5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rv3r-pq87-c5w5.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:02:48.326394787Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9b43aed5-f3c3-4d2d-b795-3eb1ac2cafdb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rv3r-pq87-c5w5","advisory_id":"9b43aed5-f3c3-4d2d-b795-3eb1ac2cafdb","event_types":["advisory"],"published_at":"2026-10-25T20:28:37.112653+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:19+00:00","detail_url":"/events/65042"},"members":[{"id":65042,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-rv3r-pq87-c5w5","summary":"CGA-rv3r-pq87-c5w5","evidence":"osv:CGA-rv3r-pq87-c5w5","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-rv3r-pq87-c5w5","aliases":["CGA-rv3r-pq87-c5w5"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rv3r-pq87-c5w5.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:02:48.326394787Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9b43aed5-f3c3-4d2d-b795-3eb1ac2cafdb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rv3r-pq87-c5w5","advisory_id":"9b43aed5-f3c3-4d2d-b795-3eb1ac2cafdb","event_types":["advisory"],"published_at":"2026-10-25T20:28:37.112653+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:19+00:00","detail_url":"/events/65042"}]}},{"id":65678,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p892-x8r2-hqj3","summary":"CGA-p892-x8r2-hqj3","evidence":"osv:CGA-p892-x8r2-hqj3","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p892-x8r2-hqj3","aliases":["CGA-p892-x8r2-hqj3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p892-x8r2-hqj3.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:02:39.640234458Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0b5a8e71-ff7c-491e-942d-6392aeae1064","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p892-x8r2-hqj3","advisory_id":"0b5a8e71-ff7c-491e-942d-6392aeae1064","event_types":["advisory"],"published_at":"2026-10-25T20:27:31.799796+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/advisories/advisory%3A0b5a8e71-ff7c-491e-942d-6392aeae1064","group":{"id":"advisory:0b5a8e71-ff7c-491e-942d-6392aeae1064","revision":1,"primary_event_id":64992,"change":"published","superseded_by":[],"changed":{"id":64992,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p892-x8r2-hqj3","summary":"CGA-p892-x8r2-hqj3","evidence":"osv:CGA-p892-x8r2-hqj3","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p892-x8r2-hqj3","aliases":["CGA-p892-x8r2-hqj3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p892-x8r2-hqj3.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:02:39.640234458Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0b5a8e71-ff7c-491e-942d-6392aeae1064","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p892-x8r2-hqj3","advisory_id":"0b5a8e71-ff7c-491e-942d-6392aeae1064","event_types":["advisory"],"published_at":"2026-10-25T20:27:31.799796+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/events/64992"},"members":[{"id":64992,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p892-x8r2-hqj3","summary":"CGA-p892-x8r2-hqj3","evidence":"osv:CGA-p892-x8r2-hqj3","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p892-x8r2-hqj3","aliases":["CGA-p892-x8r2-hqj3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p892-x8r2-hqj3.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:02:39.640234458Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0b5a8e71-ff7c-491e-942d-6392aeae1064","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p892-x8r2-hqj3","advisory_id":"0b5a8e71-ff7c-491e-942d-6392aeae1064","event_types":["advisory"],"published_at":"2026-10-25T20:27:31.799796+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/events/64992"}]}},{"id":65642,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pfq9-5xp8-2p2v","summary":"CGA-pfq9-5xp8-2p2v","evidence":"osv:CGA-pfq9-5xp8-2p2v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pfq9-5xp8-2p2v","aliases":["CGA-pfq9-5xp8-2p2v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pfq9-5xp8-2p2v.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:19Z"}]}}],"modified":"2026-10-01T23:02:25.659936667Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:beeee8e4-9fed-470e-96ad-cf706d899e76","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pfq9-5xp8-2p2v","advisory_id":"beeee8e4-9fed-470e-96ad-cf706d899e76","event_types":["advisory"],"published_at":"2026-10-25T20:27:07.651054+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:14+00:00","detail_url":"/advisories/advisory%3Abeeee8e4-9fed-470e-96ad-cf706d899e76","group":{"id":"advisory:beeee8e4-9fed-470e-96ad-cf706d899e76","revision":1,"primary_event_id":64956,"change":"published","superseded_by":[],"changed":{"id":64956,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pfq9-5xp8-2p2v","summary":"CGA-pfq9-5xp8-2p2v","evidence":"osv:CGA-pfq9-5xp8-2p2v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pfq9-5xp8-2p2v","aliases":["CGA-pfq9-5xp8-2p2v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pfq9-5xp8-2p2v.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:19Z"}]}}],"modified":"2026-10-01T23:02:25.659936667Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:beeee8e4-9fed-470e-96ad-cf706d899e76","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pfq9-5xp8-2p2v","advisory_id":"beeee8e4-9fed-470e-96ad-cf706d899e76","event_types":["advisory"],"published_at":"2026-10-25T20:27:07.651054+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:14+00:00","detail_url":"/events/64956"},"members":[{"id":64956,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-pfq9-5xp8-2p2v","summary":"CGA-pfq9-5xp8-2p2v","evidence":"osv:CGA-pfq9-5xp8-2p2v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-pfq9-5xp8-2p2v","aliases":["CGA-pfq9-5xp8-2p2v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pfq9-5xp8-2p2v.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:19Z"}]}}],"modified":"2026-10-01T23:02:25.659936667Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:beeee8e4-9fed-470e-96ad-cf706d899e76","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pfq9-5xp8-2p2v","advisory_id":"beeee8e4-9fed-470e-96ad-cf706d899e76","event_types":["advisory"],"published_at":"2026-10-25T20:27:07.651054+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:14+00:00","detail_url":"/events/64956"}]}},{"id":65590,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-hp59-mv6f-gv9q","summary":"CGA-hp59-mv6f-gv9q","evidence":"osv:CGA-hp59-mv6f-gv9q","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-hp59-mv6f-gv9q","aliases":["CGA-hp59-mv6f-gv9q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hp59-mv6f-gv9q.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:02:15.710046803Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:75b2394a-ab23-4c73-be60-b1c9c9eb0104","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hp59-mv6f-gv9q","advisory_id":"75b2394a-ab23-4c73-be60-b1c9c9eb0104","event_types":["advisory"],"published_at":"2026-10-25T20:26:26.850493+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/advisories/advisory%3A75b2394a-ab23-4c73-be60-b1c9c9eb0104","group":{"id":"advisory:75b2394a-ab23-4c73-be60-b1c9c9eb0104","revision":1,"primary_event_id":64906,"change":"published","superseded_by":[],"changed":{"id":64906,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-hp59-mv6f-gv9q","summary":"CGA-hp59-mv6f-gv9q","evidence":"osv:CGA-hp59-mv6f-gv9q","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-hp59-mv6f-gv9q","aliases":["CGA-hp59-mv6f-gv9q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hp59-mv6f-gv9q.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:02:15.710046803Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:75b2394a-ab23-4c73-be60-b1c9c9eb0104","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hp59-mv6f-gv9q","advisory_id":"75b2394a-ab23-4c73-be60-b1c9c9eb0104","event_types":["advisory"],"published_at":"2026-10-25T20:26:26.850493+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/events/64906"},"members":[{"id":64906,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-hp59-mv6f-gv9q","summary":"CGA-hp59-mv6f-gv9q","evidence":"osv:CGA-hp59-mv6f-gv9q","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-hp59-mv6f-gv9q","aliases":["CGA-hp59-mv6f-gv9q"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hp59-mv6f-gv9q.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:02:15.710046803Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:75b2394a-ab23-4c73-be60-b1c9c9eb0104","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hp59-mv6f-gv9q","advisory_id":"75b2394a-ab23-4c73-be60-b1c9c9eb0104","event_types":["advisory"],"published_at":"2026-10-25T20:26:26.850493+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/events/64906"}]}},{"id":65466,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m24p-8gcg-5m2h","summary":"CGA-m24p-8gcg-5m2h","evidence":"osv:CGA-m24p-8gcg-5m2h","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m24p-8gcg-5m2h","aliases":["CGA-m24p-8gcg-5m2h"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m24p-8gcg-5m2h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:16Z"}]}}],"modified":"2026-10-01T23:01:57.989221380Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2fb2e9b1-e580-4e3d-a1aa-1b1c5ecae806","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m24p-8gcg-5m2h","advisory_id":"2fb2e9b1-e580-4e3d-a1aa-1b1c5ecae806","event_types":["advisory"],"published_at":"2026-10-25T20:23:56.59459+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:15+00:00","detail_url":"/advisories/advisory%3A2fb2e9b1-e580-4e3d-a1aa-1b1c5ecae806","group":{"id":"advisory:2fb2e9b1-e580-4e3d-a1aa-1b1c5ecae806","revision":1,"primary_event_id":64784,"change":"published","superseded_by":[],"changed":{"id":64784,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m24p-8gcg-5m2h","summary":"CGA-m24p-8gcg-5m2h","evidence":"osv:CGA-m24p-8gcg-5m2h","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m24p-8gcg-5m2h","aliases":["CGA-m24p-8gcg-5m2h"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m24p-8gcg-5m2h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:16Z"}]}}],"modified":"2026-10-01T23:01:57.989221380Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2fb2e9b1-e580-4e3d-a1aa-1b1c5ecae806","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m24p-8gcg-5m2h","advisory_id":"2fb2e9b1-e580-4e3d-a1aa-1b1c5ecae806","event_types":["advisory"],"published_at":"2026-10-25T20:23:56.59459+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:15+00:00","detail_url":"/events/64784"},"members":[{"id":64784,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m24p-8gcg-5m2h","summary":"CGA-m24p-8gcg-5m2h","evidence":"osv:CGA-m24p-8gcg-5m2h","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m24p-8gcg-5m2h","aliases":["CGA-m24p-8gcg-5m2h"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m24p-8gcg-5m2h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:16Z"}]}}],"modified":"2026-10-01T23:01:57.989221380Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2fb2e9b1-e580-4e3d-a1aa-1b1c5ecae806","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m24p-8gcg-5m2h","advisory_id":"2fb2e9b1-e580-4e3d-a1aa-1b1c5ecae806","event_types":["advisory"],"published_at":"2026-10-25T20:23:56.59459+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:15+00:00","detail_url":"/events/64784"}]}},{"id":65382,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-9wqx-m8r5-hv4v","summary":"CGA-9wqx-m8r5-hv4v","evidence":"osv:CGA-9wqx-m8r5-hv4v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9wqx-m8r5-hv4v","aliases":["CGA-9wqx-m8r5-hv4v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wqx-m8r5-hv4v.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:17Z"}]}}],"modified":"2026-10-01T23:01:48.415366211Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4957cec0-2fe2-4e16-a7b0-cab0dc9cb944","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9wqx-m8r5-hv4v","advisory_id":"4957cec0-2fe2-4e16-a7b0-cab0dc9cb944","event_types":["advisory"],"published_at":"2026-10-25T20:22:51.131545+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:16+00:00","detail_url":"/advisories/advisory%3A4957cec0-2fe2-4e16-a7b0-cab0dc9cb944","group":{"id":"advisory:4957cec0-2fe2-4e16-a7b0-cab0dc9cb944","revision":1,"primary_event_id":64702,"change":"published","superseded_by":[],"changed":{"id":64702,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-9wqx-m8r5-hv4v","summary":"CGA-9wqx-m8r5-hv4v","evidence":"osv:CGA-9wqx-m8r5-hv4v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9wqx-m8r5-hv4v","aliases":["CGA-9wqx-m8r5-hv4v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wqx-m8r5-hv4v.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:17Z"}]}}],"modified":"2026-10-01T23:01:48.415366211Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4957cec0-2fe2-4e16-a7b0-cab0dc9cb944","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9wqx-m8r5-hv4v","advisory_id":"4957cec0-2fe2-4e16-a7b0-cab0dc9cb944","event_types":["advisory"],"published_at":"2026-10-25T20:22:51.131545+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:16+00:00","detail_url":"/events/64702"},"members":[{"id":64702,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-9wqx-m8r5-hv4v","summary":"CGA-9wqx-m8r5-hv4v","evidence":"osv:CGA-9wqx-m8r5-hv4v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9wqx-m8r5-hv4v","aliases":["CGA-9wqx-m8r5-hv4v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wqx-m8r5-hv4v.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:17Z"}]}}],"modified":"2026-10-01T23:01:48.415366211Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4957cec0-2fe2-4e16-a7b0-cab0dc9cb944","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9wqx-m8r5-hv4v","advisory_id":"4957cec0-2fe2-4e16-a7b0-cab0dc9cb944","event_types":["advisory"],"published_at":"2026-10-25T20:22:51.131545+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:16+00:00","detail_url":"/events/64702"}]}},{"id":65296,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5p7c-x3mv-66wj","summary":"CGA-5p7c-x3mv-66wj","evidence":"osv:CGA-5p7c-x3mv-66wj","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5p7c-x3mv-66wj","aliases":["CGA-5p7c-x3mv-66wj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5p7c-x3mv-66wj.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:15Z"}]}}],"modified":"2026-10-01T23:01:37.838736392Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ebdf430c-9f9a-4260-980a-81753142abd0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5p7c-x3mv-66wj","advisory_id":"ebdf430c-9f9a-4260-980a-81753142abd0","event_types":["advisory"],"published_at":"2026-10-25T20:21:46.312916+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:13+00:00","detail_url":"/advisories/advisory%3Aebdf430c-9f9a-4260-980a-81753142abd0","group":{"id":"advisory:ebdf430c-9f9a-4260-980a-81753142abd0","revision":1,"primary_event_id":64618,"change":"published","superseded_by":[],"changed":{"id":64618,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5p7c-x3mv-66wj","summary":"CGA-5p7c-x3mv-66wj","evidence":"osv:CGA-5p7c-x3mv-66wj","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5p7c-x3mv-66wj","aliases":["CGA-5p7c-x3mv-66wj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5p7c-x3mv-66wj.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:15Z"}]}}],"modified":"2026-10-01T23:01:37.838736392Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ebdf430c-9f9a-4260-980a-81753142abd0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5p7c-x3mv-66wj","advisory_id":"ebdf430c-9f9a-4260-980a-81753142abd0","event_types":["advisory"],"published_at":"2026-10-25T20:21:46.312916+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:13+00:00","detail_url":"/events/64618"},"members":[{"id":64618,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5p7c-x3mv-66wj","summary":"CGA-5p7c-x3mv-66wj","evidence":"osv:CGA-5p7c-x3mv-66wj","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5p7c-x3mv-66wj","aliases":["CGA-5p7c-x3mv-66wj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5p7c-x3mv-66wj.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:15Z"}]}}],"modified":"2026-10-01T23:01:37.838736392Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ebdf430c-9f9a-4260-980a-81753142abd0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5p7c-x3mv-66wj","advisory_id":"ebdf430c-9f9a-4260-980a-81753142abd0","event_types":["advisory"],"published_at":"2026-10-25T20:21:46.312916+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:13+00:00","detail_url":"/events/64618"}]}},{"id":65257,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-x688-46g2-8hhg","summary":"CGA-x688-46g2-8hhg","evidence":"osv:CGA-x688-46g2-8hhg","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x688-46g2-8hhg","aliases":["CGA-x688-46g2-8hhg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x688-46g2-8hhg.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:01:33.350299486Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9063ce47-9114-42c0-b1b5-10ec13896781","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x688-46g2-8hhg","advisory_id":"9063ce47-9114-42c0-b1b5-10ec13896781","event_types":["advisory"],"published_at":"2026-10-25T20:20:26.429271+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:21+00:00","detail_url":"/advisories/advisory%3A9063ce47-9114-42c0-b1b5-10ec13896781","group":{"id":"advisory:9063ce47-9114-42c0-b1b5-10ec13896781","revision":1,"primary_event_id":64579,"change":"published","superseded_by":[],"changed":{"id":64579,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-x688-46g2-8hhg","summary":"CGA-x688-46g2-8hhg","evidence":"osv:CGA-x688-46g2-8hhg","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x688-46g2-8hhg","aliases":["CGA-x688-46g2-8hhg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x688-46g2-8hhg.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:01:33.350299486Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9063ce47-9114-42c0-b1b5-10ec13896781","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x688-46g2-8hhg","advisory_id":"9063ce47-9114-42c0-b1b5-10ec13896781","event_types":["advisory"],"published_at":"2026-10-25T20:20:26.429271+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:21+00:00","detail_url":"/events/64579"},"members":[{"id":64579,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-x688-46g2-8hhg","summary":"CGA-x688-46g2-8hhg","evidence":"osv:CGA-x688-46g2-8hhg","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-x688-46g2-8hhg","aliases":["CGA-x688-46g2-8hhg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-x688-46g2-8hhg.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:01:33.350299486Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9063ce47-9114-42c0-b1b5-10ec13896781","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-x688-46g2-8hhg","advisory_id":"9063ce47-9114-42c0-b1b5-10ec13896781","event_types":["advisory"],"published_at":"2026-10-25T20:20:26.429271+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:21+00:00","detail_url":"/events/64579"}]}},{"id":65204,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-v24p-3whp-4mhg","summary":"CGA-v24p-3whp-4mhg","evidence":"osv:CGA-v24p-3whp-4mhg","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-v24p-3whp-4mhg","aliases":["CGA-v24p-3whp-4mhg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v24p-3whp-4mhg.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:01:28.023172026Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c577a044-1160-4aab-966b-f616f2745463","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v24p-3whp-4mhg","advisory_id":"c577a044-1160-4aab-966b-f616f2745463","event_types":["advisory"],"published_at":"2026-10-25T20:19:47.057131+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:21+00:00","detail_url":"/advisories/advisory%3Ac577a044-1160-4aab-966b-f616f2745463","group":{"id":"advisory:c577a044-1160-4aab-966b-f616f2745463","revision":1,"primary_event_id":64528,"change":"published","superseded_by":[],"changed":{"id":64528,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-v24p-3whp-4mhg","summary":"CGA-v24p-3whp-4mhg","evidence":"osv:CGA-v24p-3whp-4mhg","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-v24p-3whp-4mhg","aliases":["CGA-v24p-3whp-4mhg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v24p-3whp-4mhg.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:01:28.023172026Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c577a044-1160-4aab-966b-f616f2745463","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v24p-3whp-4mhg","advisory_id":"c577a044-1160-4aab-966b-f616f2745463","event_types":["advisory"],"published_at":"2026-10-25T20:19:47.057131+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:21+00:00","detail_url":"/events/64528"},"members":[{"id":64528,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-v24p-3whp-4mhg","summary":"CGA-v24p-3whp-4mhg","evidence":"osv:CGA-v24p-3whp-4mhg","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-v24p-3whp-4mhg","aliases":["CGA-v24p-3whp-4mhg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v24p-3whp-4mhg.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:01:28.023172026Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c577a044-1160-4aab-966b-f616f2745463","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v24p-3whp-4mhg","advisory_id":"c577a044-1160-4aab-966b-f616f2745463","event_types":["advisory"],"published_at":"2026-10-25T20:19:47.057131+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:21+00:00","detail_url":"/events/64528"}]}},{"id":65101,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-j369-w9rv-pr76","summary":"CGA-j369-w9rv-pr76","evidence":"osv:CGA-j369-w9rv-pr76","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j369-w9rv-pr76","aliases":["CGA-j369-w9rv-pr76"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j369-w9rv-pr76.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:15Z"}]}}],"modified":"2026-10-01T23:01:06.396847142Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:43898732-d67e-40d7-937e-76530ef4e9cb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j369-w9rv-pr76","advisory_id":"43898732-d67e-40d7-937e-76530ef4e9cb","event_types":["advisory"],"published_at":"2026-10-25T20:00:29.872222+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:15+00:00","detail_url":"/advisories/advisory%3A43898732-d67e-40d7-937e-76530ef4e9cb","group":{"id":"advisory:43898732-d67e-40d7-937e-76530ef4e9cb","revision":1,"primary_event_id":64428,"change":"published","superseded_by":[],"changed":{"id":64428,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-j369-w9rv-pr76","summary":"CGA-j369-w9rv-pr76","evidence":"osv:CGA-j369-w9rv-pr76","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j369-w9rv-pr76","aliases":["CGA-j369-w9rv-pr76"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j369-w9rv-pr76.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:15Z"}]}}],"modified":"2026-10-01T23:01:06.396847142Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:43898732-d67e-40d7-937e-76530ef4e9cb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j369-w9rv-pr76","advisory_id":"43898732-d67e-40d7-937e-76530ef4e9cb","event_types":["advisory"],"published_at":"2026-10-25T20:00:29.872222+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:15+00:00","detail_url":"/events/64428"},"members":[{"id":64428,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-j369-w9rv-pr76","summary":"CGA-j369-w9rv-pr76","evidence":"osv:CGA-j369-w9rv-pr76","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-j369-w9rv-pr76","aliases":["CGA-j369-w9rv-pr76"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j369-w9rv-pr76.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:15Z"}]}}],"modified":"2026-10-01T23:01:06.396847142Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:43898732-d67e-40d7-937e-76530ef4e9cb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j369-w9rv-pr76","advisory_id":"43898732-d67e-40d7-937e-76530ef4e9cb","event_types":["advisory"],"published_at":"2026-10-25T20:00:29.872222+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:15+00:00","detail_url":"/events/64428"}]}},{"id":65067,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-g862-935h-cpvc","summary":"CGA-g862-935h-cpvc","evidence":"osv:CGA-g862-935h-cpvc","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g862-935h-cpvc","aliases":["CGA-g862-935h-cpvc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g862-935h-cpvc.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:01:00.828397299Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea156c65-b72a-4f22-bd59-db3bfca66075","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g862-935h-cpvc","advisory_id":"ea156c65-b72a-4f22-bd59-db3bfca66075","event_types":["advisory"],"published_at":"2026-10-25T19:59:59.212589+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:19+00:00","detail_url":"/advisories/advisory%3Aea156c65-b72a-4f22-bd59-db3bfca66075","group":{"id":"advisory:ea156c65-b72a-4f22-bd59-db3bfca66075","revision":1,"primary_event_id":64394,"change":"published","superseded_by":[],"changed":{"id":64394,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-g862-935h-cpvc","summary":"CGA-g862-935h-cpvc","evidence":"osv:CGA-g862-935h-cpvc","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g862-935h-cpvc","aliases":["CGA-g862-935h-cpvc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g862-935h-cpvc.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:01:00.828397299Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea156c65-b72a-4f22-bd59-db3bfca66075","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g862-935h-cpvc","advisory_id":"ea156c65-b72a-4f22-bd59-db3bfca66075","event_types":["advisory"],"published_at":"2026-10-25T19:59:59.212589+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:19+00:00","detail_url":"/events/64394"},"members":[{"id":64394,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-g862-935h-cpvc","summary":"CGA-g862-935h-cpvc","evidence":"osv:CGA-g862-935h-cpvc","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g862-935h-cpvc","aliases":["CGA-g862-935h-cpvc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g862-935h-cpvc.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:01:00.828397299Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ea156c65-b72a-4f22-bd59-db3bfca66075","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g862-935h-cpvc","advisory_id":"ea156c65-b72a-4f22-bd59-db3bfca66075","event_types":["advisory"],"published_at":"2026-10-25T19:59:59.212589+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:19+00:00","detail_url":"/events/64394"}]}},{"id":65021,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c8vg-38xw-m95v","summary":"CGA-c8vg-38xw-m95v","evidence":"osv:CGA-c8vg-38xw-m95v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c8vg-38xw-m95v","aliases":["CGA-c8vg-38xw-m95v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8vg-38xw-m95v.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:00:55.562478809Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:808f70f2-4723-41fb-8077-c5dff3c91a47","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c8vg-38xw-m95v","advisory_id":"808f70f2-4723-41fb-8077-c5dff3c91a47","event_types":["advisory"],"published_at":"2026-10-25T19:59:23.842608+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/advisories/advisory%3A808f70f2-4723-41fb-8077-c5dff3c91a47","group":{"id":"advisory:808f70f2-4723-41fb-8077-c5dff3c91a47","revision":1,"primary_event_id":64348,"change":"published","superseded_by":[],"changed":{"id":64348,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c8vg-38xw-m95v","summary":"CGA-c8vg-38xw-m95v","evidence":"osv:CGA-c8vg-38xw-m95v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c8vg-38xw-m95v","aliases":["CGA-c8vg-38xw-m95v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8vg-38xw-m95v.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:00:55.562478809Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:808f70f2-4723-41fb-8077-c5dff3c91a47","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c8vg-38xw-m95v","advisory_id":"808f70f2-4723-41fb-8077-c5dff3c91a47","event_types":["advisory"],"published_at":"2026-10-25T19:59:23.842608+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/events/64348"},"members":[{"id":64348,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c8vg-38xw-m95v","summary":"CGA-c8vg-38xw-m95v","evidence":"osv:CGA-c8vg-38xw-m95v","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c8vg-38xw-m95v","aliases":["CGA-c8vg-38xw-m95v"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c8vg-38xw-m95v.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:00:55.562478809Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:808f70f2-4723-41fb-8077-c5dff3c91a47","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c8vg-38xw-m95v","advisory_id":"808f70f2-4723-41fb-8077-c5dff3c91a47","event_types":["advisory"],"published_at":"2026-10-25T19:59:23.842608+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:20+00:00","detail_url":"/events/64348"}]}},{"id":64945,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-83gq-3pvf-ph4x","summary":"CGA-83gq-3pvf-ph4x","evidence":"osv:CGA-83gq-3pvf-ph4x","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-83gq-3pvf-ph4x","aliases":["CGA-83gq-3pvf-ph4x"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-83gq-3pvf-ph4x.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:17Z"}]}}],"modified":"2026-10-01T23:00:46.710530925Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cae936eb-44a4-404b-a909-37821712083c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-83gq-3pvf-ph4x","advisory_id":"cae936eb-44a4-404b-a909-37821712083c","event_types":["advisory"],"published_at":"2026-10-25T19:58:03.30383+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:17+00:00","detail_url":"/advisories/advisory%3Acae936eb-44a4-404b-a909-37821712083c","group":{"id":"advisory:cae936eb-44a4-404b-a909-37821712083c","revision":1,"primary_event_id":64274,"change":"published","superseded_by":[],"changed":{"id":64274,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-83gq-3pvf-ph4x","summary":"CGA-83gq-3pvf-ph4x","evidence":"osv:CGA-83gq-3pvf-ph4x","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-83gq-3pvf-ph4x","aliases":["CGA-83gq-3pvf-ph4x"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-83gq-3pvf-ph4x.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:17Z"}]}}],"modified":"2026-10-01T23:00:46.710530925Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cae936eb-44a4-404b-a909-37821712083c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-83gq-3pvf-ph4x","advisory_id":"cae936eb-44a4-404b-a909-37821712083c","event_types":["advisory"],"published_at":"2026-10-25T19:58:03.30383+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:17+00:00","detail_url":"/events/64274"},"members":[{"id":64274,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-83gq-3pvf-ph4x","summary":"CGA-83gq-3pvf-ph4x","evidence":"osv:CGA-83gq-3pvf-ph4x","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-83gq-3pvf-ph4x","aliases":["CGA-83gq-3pvf-ph4x"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-83gq-3pvf-ph4x.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:17Z"}]}}],"modified":"2026-10-01T23:00:46.710530925Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cae936eb-44a4-404b-a909-37821712083c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-83gq-3pvf-ph4x","advisory_id":"cae936eb-44a4-404b-a909-37821712083c","event_types":["advisory"],"published_at":"2026-10-25T19:58:03.30383+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:17+00:00","detail_url":"/events/64274"}]}},{"id":64941,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-8vgj-9f7j-cj7j","summary":"CGA-8vgj-9f7j-cj7j","evidence":"osv:CGA-8vgj-9f7j-cj7j","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8vgj-9f7j-cj7j","aliases":["CGA-8vgj-9f7j-cj7j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8vgj-9f7j-cj7j.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:19Z"}]}}],"modified":"2026-10-01T23:00:46.229355814Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:456ee117-64ec-436f-99ab-036e364fc5e6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8vgj-9f7j-cj7j","advisory_id":"456ee117-64ec-436f-99ab-036e364fc5e6","event_types":["advisory"],"published_at":"2026-10-25T19:58:00.239271+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:12+00:00","detail_url":"/advisories/advisory%3A456ee117-64ec-436f-99ab-036e364fc5e6","group":{"id":"advisory:456ee117-64ec-436f-99ab-036e364fc5e6","revision":1,"primary_event_id":64270,"change":"published","superseded_by":[],"changed":{"id":64270,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-8vgj-9f7j-cj7j","summary":"CGA-8vgj-9f7j-cj7j","evidence":"osv:CGA-8vgj-9f7j-cj7j","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8vgj-9f7j-cj7j","aliases":["CGA-8vgj-9f7j-cj7j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8vgj-9f7j-cj7j.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:19Z"}]}}],"modified":"2026-10-01T23:00:46.229355814Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:456ee117-64ec-436f-99ab-036e364fc5e6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8vgj-9f7j-cj7j","advisory_id":"456ee117-64ec-436f-99ab-036e364fc5e6","event_types":["advisory"],"published_at":"2026-10-25T19:58:00.239271+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:12+00:00","detail_url":"/events/64270"},"members":[{"id":64270,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-8vgj-9f7j-cj7j","summary":"CGA-8vgj-9f7j-cj7j","evidence":"osv:CGA-8vgj-9f7j-cj7j","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-8vgj-9f7j-cj7j","aliases":["CGA-8vgj-9f7j-cj7j"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8vgj-9f7j-cj7j.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T18:45:19Z"}]}}],"modified":"2026-10-01T23:00:46.229355814Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:456ee117-64ec-436f-99ab-036e364fc5e6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8vgj-9f7j-cj7j","advisory_id":"456ee117-64ec-436f-99ab-036e364fc5e6","event_types":["advisory"],"published_at":"2026-10-25T19:58:00.239271+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T11:47:12+00:00","detail_url":"/events/64270"}]}},{"id":64935,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7563-x834-957h","summary":"CGA-7563-x834-957h","evidence":"osv:CGA-7563-x834-957h","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7563-x834-957h","aliases":["CGA-7563-x834-957h"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7563-x834-957h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:00:45.000459620Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:49e9abff-03c2-47be-9a6a-a99be6b249f6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7563-x834-957h","advisory_id":"49e9abff-03c2-47be-9a6a-a99be6b249f6","event_types":["advisory"],"published_at":"2026-10-25T19:57:56.046164+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:18+00:00","detail_url":"/advisories/advisory%3A49e9abff-03c2-47be-9a6a-a99be6b249f6","group":{"id":"advisory:49e9abff-03c2-47be-9a6a-a99be6b249f6","revision":1,"primary_event_id":64264,"change":"published","superseded_by":[],"changed":{"id":64264,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7563-x834-957h","summary":"CGA-7563-x834-957h","evidence":"osv:CGA-7563-x834-957h","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7563-x834-957h","aliases":["CGA-7563-x834-957h"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7563-x834-957h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:00:45.000459620Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:49e9abff-03c2-47be-9a6a-a99be6b249f6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7563-x834-957h","advisory_id":"49e9abff-03c2-47be-9a6a-a99be6b249f6","event_types":["advisory"],"published_at":"2026-10-25T19:57:56.046164+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:18+00:00","detail_url":"/events/64264"},"members":[{"id":64264,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-7563-x834-957h","summary":"CGA-7563-x834-957h","evidence":"osv:CGA-7563-x834-957h","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-7563-x834-957h","aliases":["CGA-7563-x834-957h"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7563-x834-957h.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:04Z"}]}}],"modified":"2026-10-01T23:00:45.000459620Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:49e9abff-03c2-47be-9a6a-a99be6b249f6","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7563-x834-957h","advisory_id":"49e9abff-03c2-47be-9a6a-a99be6b249f6","event_types":["advisory"],"published_at":"2026-10-25T19:57:56.046164+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:18+00:00","detail_url":"/events/64264"}]}},{"id":64850,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4w4h-w285-m7xc","summary":"CGA-4w4h-w285-m7xc","evidence":"osv:CGA-4w4h-w285-m7xc","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4w4h-w285-m7xc","aliases":["CGA-4w4h-w285-m7xc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4w4h-w285-m7xc.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:00:36.606120250Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ef31712f-1471-4ebe-8abe-045aa197335f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4w4h-w285-m7xc","advisory_id":"ef31712f-1471-4ebe-8abe-045aa197335f","event_types":["advisory"],"published_at":"2026-10-25T19:56:27.11207+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:18+00:00","detail_url":"/advisories/advisory%3Aef31712f-1471-4ebe-8abe-045aa197335f","group":{"id":"advisory:ef31712f-1471-4ebe-8abe-045aa197335f","revision":1,"primary_event_id":64189,"change":"published","superseded_by":[],"changed":{"id":64189,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4w4h-w285-m7xc","summary":"CGA-4w4h-w285-m7xc","evidence":"osv:CGA-4w4h-w285-m7xc","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4w4h-w285-m7xc","aliases":["CGA-4w4h-w285-m7xc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4w4h-w285-m7xc.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:00:36.606120250Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ef31712f-1471-4ebe-8abe-045aa197335f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4w4h-w285-m7xc","advisory_id":"ef31712f-1471-4ebe-8abe-045aa197335f","event_types":["advisory"],"published_at":"2026-10-25T19:56:27.11207+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:18+00:00","detail_url":"/events/64189"},"members":[{"id":64189,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4w4h-w285-m7xc","summary":"CGA-4w4h-w285-m7xc","evidence":"osv:CGA-4w4h-w285-m7xc","products":[{"name":{"value":"langfuse-4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.49.0-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4w4h-w285-m7xc","aliases":["CGA-4w4h-w285-m7xc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.49.0-r0"}]}],"package":{"name":"langfuse-4","purl":"pkg:apk/chainguard/langfuse-4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4w4h-w285-m7xc.json"},"ecosystem_specific":{"components":[{"component_name":"axios","component_purl":"pkg:npm/axios@1.18.0","component_type":"npm","component_version":"1.18.0","component_location":"/app/node_modules/.pnpm/axios@1.18.0_debug@4.4.3_supports-color@8.1.1__supports-color@8.1.1/node_modules/axios/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:08:05Z"}]}}],"modified":"2026-10-01T23:00:36.606120250Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ef31712f-1471-4ebe-8abe-045aa197335f","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4w4h-w285-m7xc","advisory_id":"ef31712f-1471-4ebe-8abe-045aa197335f","event_types":["advisory"],"published_at":"2026-10-25T19:56:27.11207+00:00","technologies":["core-osv","langfuse-4"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T12:29:18+00:00","detail_url":"/events/64189"}]}}],"next_after":72050,"next_before":64850}