{"schema_version":"2","view":"grouped","data":[{"id":70941,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-98q6-p7h2-9cmf","summary":"CGA-98q6-p7h2-9cmf","evidence":"osv:CGA-98q6-p7h2-9cmf","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-98q6-p7h2-9cmf","aliases":["CGA-98q6-p7h2-9cmf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98q6-p7h2-9cmf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98q6-p7h2-9cmf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}}],"modified":"2026-10-02T18:28:01.780552674Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:46dcae08-5ad4-4fa7-9906-e9c8f350122a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98q6-p7h2-9cmf","advisory_id":"46dcae08-5ad4-4fa7-9906-e9c8f350122a","event_types":["advisory"],"published_at":"2026-10-25T22:45:10.026826+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:53+00:00","detail_url":"/advisories/advisory%3A46dcae08-5ad4-4fa7-9906-e9c8f350122a","group":{"id":"advisory:46dcae08-5ad4-4fa7-9906-e9c8f350122a","revision":1,"primary_event_id":71312,"change":"published","superseded_by":[],"changed":{"id":71312,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-98q6-p7h2-9cmf","summary":"CGA-98q6-p7h2-9cmf","evidence":"osv:CGA-98q6-p7h2-9cmf","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-98q6-p7h2-9cmf","aliases":["CGA-98q6-p7h2-9cmf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98q6-p7h2-9cmf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98q6-p7h2-9cmf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}}],"modified":"2026-10-02T18:28:01.780552674Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:46dcae08-5ad4-4fa7-9906-e9c8f350122a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98q6-p7h2-9cmf","advisory_id":"46dcae08-5ad4-4fa7-9906-e9c8f350122a","event_types":["advisory"],"published_at":"2026-10-25T22:45:10.026826+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:53+00:00","detail_url":"/events/71312"},"members":[{"id":71312,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-98q6-p7h2-9cmf","summary":"CGA-98q6-p7h2-9cmf","evidence":"osv:CGA-98q6-p7h2-9cmf","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-98q6-p7h2-9cmf","aliases":["CGA-98q6-p7h2-9cmf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98q6-p7h2-9cmf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98q6-p7h2-9cmf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}}],"modified":"2026-10-02T18:28:01.780552674Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:46dcae08-5ad4-4fa7-9906-e9c8f350122a","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98q6-p7h2-9cmf","advisory_id":"46dcae08-5ad4-4fa7-9906-e9c8f350122a","event_types":["advisory"],"published_at":"2026-10-25T22:45:10.026826+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:53+00:00","detail_url":"/events/71312"}]}},{"id":70937,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-fjpq-6fx9-rvh9","summary":"CGA-fjpq-6fx9-rvh9","evidence":"osv:CGA-fjpq-6fx9-rvh9","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fjpq-6fx9-rvh9","aliases":["CGA-fjpq-6fx9-rvh9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjpq-6fx9-rvh9.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjpq-6fx9-rvh9.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}}],"modified":"2026-10-02T18:28:00.472086446Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c39d2ba7-8117-4473-a508-cff79845d905","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fjpq-6fx9-rvh9","advisory_id":"c39d2ba7-8117-4473-a508-cff79845d905","event_types":["advisory"],"published_at":"2026-10-25T22:45:05.882964+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:57+00:00","detail_url":"/advisories/advisory%3Ac39d2ba7-8117-4473-a508-cff79845d905","group":{"id":"advisory:c39d2ba7-8117-4473-a508-cff79845d905","revision":1,"primary_event_id":71308,"change":"published","superseded_by":[],"changed":{"id":71308,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-fjpq-6fx9-rvh9","summary":"CGA-fjpq-6fx9-rvh9","evidence":"osv:CGA-fjpq-6fx9-rvh9","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fjpq-6fx9-rvh9","aliases":["CGA-fjpq-6fx9-rvh9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjpq-6fx9-rvh9.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjpq-6fx9-rvh9.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}}],"modified":"2026-10-02T18:28:00.472086446Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c39d2ba7-8117-4473-a508-cff79845d905","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fjpq-6fx9-rvh9","advisory_id":"c39d2ba7-8117-4473-a508-cff79845d905","event_types":["advisory"],"published_at":"2026-10-25T22:45:05.882964+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:57+00:00","detail_url":"/events/71308"},"members":[{"id":71308,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-fjpq-6fx9-rvh9","summary":"CGA-fjpq-6fx9-rvh9","evidence":"osv:CGA-fjpq-6fx9-rvh9","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-fjpq-6fx9-rvh9","aliases":["CGA-fjpq-6fx9-rvh9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjpq-6fx9-rvh9.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fjpq-6fx9-rvh9.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}}],"modified":"2026-10-02T18:28:00.472086446Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c39d2ba7-8117-4473-a508-cff79845d905","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fjpq-6fx9-rvh9","advisory_id":"c39d2ba7-8117-4473-a508-cff79845d905","event_types":["advisory"],"published_at":"2026-10-25T22:45:05.882964+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:57+00:00","detail_url":"/events/71308"}]}},{"id":70919,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-366c-3fqr-j7fp","summary":"CGA-366c-3fqr-j7fp","evidence":"osv:CGA-366c-3fqr-j7fp","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-366c-3fqr-j7fp","aliases":["CGA-366c-3fqr-j7fp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-366c-3fqr-j7fp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-366c-3fqr-j7fp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-02T18:27:56.168472275Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e8c0f382-abd7-4f35-be94-34e5273491bf","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-366c-3fqr-j7fp","advisory_id":"e8c0f382-abd7-4f35-be94-34e5273491bf","event_types":["advisory"],"published_at":"2026-10-25T22:44:37.183633+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:58+00:00","detail_url":"/advisories/advisory%3Ae8c0f382-abd7-4f35-be94-34e5273491bf","group":{"id":"advisory:e8c0f382-abd7-4f35-be94-34e5273491bf","revision":1,"primary_event_id":71290,"change":"published","superseded_by":[],"changed":{"id":71290,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-366c-3fqr-j7fp","summary":"CGA-366c-3fqr-j7fp","evidence":"osv:CGA-366c-3fqr-j7fp","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-366c-3fqr-j7fp","aliases":["CGA-366c-3fqr-j7fp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-366c-3fqr-j7fp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-366c-3fqr-j7fp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-02T18:27:56.168472275Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e8c0f382-abd7-4f35-be94-34e5273491bf","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-366c-3fqr-j7fp","advisory_id":"e8c0f382-abd7-4f35-be94-34e5273491bf","event_types":["advisory"],"published_at":"2026-10-25T22:44:37.183633+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:58+00:00","detail_url":"/events/71290"},"members":[{"id":71290,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-366c-3fqr-j7fp","summary":"CGA-366c-3fqr-j7fp","evidence":"osv:CGA-366c-3fqr-j7fp","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-366c-3fqr-j7fp","aliases":["CGA-366c-3fqr-j7fp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-366c-3fqr-j7fp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-366c-3fqr-j7fp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctlclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-02T18:27:56.168472275Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e8c0f382-abd7-4f35-be94-34e5273491bf","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-366c-3fqr-j7fp","advisory_id":"e8c0f382-abd7-4f35-be94-34e5273491bf","event_types":["advisory"],"published_at":"2026-10-25T22:44:37.183633+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:58+00:00","detail_url":"/events/71290"}]}},{"id":70915,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-wm8p-66v8-hpx7","summary":"CGA-wm8p-66v8-hpx7","evidence":"osv:CGA-wm8p-66v8-hpx7","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wm8p-66v8-hpx7","aliases":["CGA-wm8p-66v8-hpx7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wm8p-66v8-hpx7.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wm8p-66v8-hpx7.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-02T18:27:54.978985676Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b1c814ee-d579-4b66-9e4b-c4aefc784405","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wm8p-66v8-hpx7","advisory_id":"b1c814ee-d579-4b66-9e4b-c4aefc784405","event_types":["advisory"],"published_at":"2026-10-25T22:44:32.864542+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:55+00:00","detail_url":"/advisories/advisory%3Ab1c814ee-d579-4b66-9e4b-c4aefc784405","group":{"id":"advisory:b1c814ee-d579-4b66-9e4b-c4aefc784405","revision":1,"primary_event_id":71286,"change":"published","superseded_by":[],"changed":{"id":71286,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-wm8p-66v8-hpx7","summary":"CGA-wm8p-66v8-hpx7","evidence":"osv:CGA-wm8p-66v8-hpx7","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wm8p-66v8-hpx7","aliases":["CGA-wm8p-66v8-hpx7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wm8p-66v8-hpx7.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wm8p-66v8-hpx7.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-02T18:27:54.978985676Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b1c814ee-d579-4b66-9e4b-c4aefc784405","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wm8p-66v8-hpx7","advisory_id":"b1c814ee-d579-4b66-9e4b-c4aefc784405","event_types":["advisory"],"published_at":"2026-10-25T22:44:32.864542+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:55+00:00","detail_url":"/events/71286"},"members":[{"id":71286,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-wm8p-66v8-hpx7","summary":"CGA-wm8p-66v8-hpx7","evidence":"osv:CGA-wm8p-66v8-hpx7","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wm8p-66v8-hpx7","aliases":["CGA-wm8p-66v8-hpx7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wm8p-66v8-hpx7.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wm8p-66v8-hpx7.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-02T18:27:54.978985676Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b1c814ee-d579-4b66-9e4b-c4aefc784405","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wm8p-66v8-hpx7","advisory_id":"b1c814ee-d579-4b66-9e4b-c4aefc784405","event_types":["advisory"],"published_at":"2026-10-25T22:44:32.864542+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:55+00:00","detail_url":"/events/71286"}]}},{"id":70901,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-cvqv-89pg-hm8m","summary":"CGA-cvqv-89pg-hm8m","evidence":"osv:CGA-cvqv-89pg-hm8m","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cvqv-89pg-hm8m","aliases":["CGA-cvqv-89pg-hm8m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cvqv-89pg-hm8m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cvqv-89pg-hm8m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}}],"modified":"2026-10-02T18:27:53.017682603Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d9a06cf5-1247-447b-bf7d-d5a0d9d94b2f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cvqv-89pg-hm8m","advisory_id":"d9a06cf5-1247-447b-bf7d-d5a0d9d94b2f","event_types":["advisory"],"published_at":"2026-10-25T22:44:19.037232+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:54+00:00","detail_url":"/advisories/advisory%3Ad9a06cf5-1247-447b-bf7d-d5a0d9d94b2f","group":{"id":"advisory:d9a06cf5-1247-447b-bf7d-d5a0d9d94b2f","revision":1,"primary_event_id":71272,"change":"published","superseded_by":[],"changed":{"id":71272,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-cvqv-89pg-hm8m","summary":"CGA-cvqv-89pg-hm8m","evidence":"osv:CGA-cvqv-89pg-hm8m","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cvqv-89pg-hm8m","aliases":["CGA-cvqv-89pg-hm8m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cvqv-89pg-hm8m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cvqv-89pg-hm8m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}}],"modified":"2026-10-02T18:27:53.017682603Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d9a06cf5-1247-447b-bf7d-d5a0d9d94b2f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cvqv-89pg-hm8m","advisory_id":"d9a06cf5-1247-447b-bf7d-d5a0d9d94b2f","event_types":["advisory"],"published_at":"2026-10-25T22:44:19.037232+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:54+00:00","detail_url":"/events/71272"},"members":[{"id":71272,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-cvqv-89pg-hm8m","summary":"CGA-cvqv-89pg-hm8m","evidence":"osv:CGA-cvqv-89pg-hm8m","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cvqv-89pg-hm8m","aliases":["CGA-cvqv-89pg-hm8m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cvqv-89pg-hm8m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cvqv-89pg-hm8m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}}],"modified":"2026-10-02T18:27:53.017682603Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d9a06cf5-1247-447b-bf7d-d5a0d9d94b2f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cvqv-89pg-hm8m","advisory_id":"d9a06cf5-1247-447b-bf7d-d5a0d9d94b2f","event_types":["advisory"],"published_at":"2026-10-25T22:44:19.037232+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:54+00:00","detail_url":"/events/71272"}]}},{"id":70898,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-hfvw-8x32-38cp","summary":"CGA-hfvw-8x32-38cp","evidence":"osv:CGA-hfvw-8x32-38cp","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hfvw-8x32-38cp","aliases":["CGA-hfvw-8x32-38cp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfvw-8x32-38cp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfvw-8x32-38cp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-02T18:27:52.325915729Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:81aebb2d-f579-4a26-8d1e-3eec3b853350","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hfvw-8x32-38cp","advisory_id":"81aebb2d-f579-4a26-8d1e-3eec3b853350","event_types":["advisory"],"published_at":"2026-10-25T22:44:12.249472+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:57+00:00","detail_url":"/advisories/advisory%3A81aebb2d-f579-4a26-8d1e-3eec3b853350","group":{"id":"advisory:81aebb2d-f579-4a26-8d1e-3eec3b853350","revision":1,"primary_event_id":71269,"change":"published","superseded_by":[],"changed":{"id":71269,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-hfvw-8x32-38cp","summary":"CGA-hfvw-8x32-38cp","evidence":"osv:CGA-hfvw-8x32-38cp","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hfvw-8x32-38cp","aliases":["CGA-hfvw-8x32-38cp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfvw-8x32-38cp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfvw-8x32-38cp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-02T18:27:52.325915729Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:81aebb2d-f579-4a26-8d1e-3eec3b853350","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hfvw-8x32-38cp","advisory_id":"81aebb2d-f579-4a26-8d1e-3eec3b853350","event_types":["advisory"],"published_at":"2026-10-25T22:44:12.249472+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:57+00:00","detail_url":"/events/71269"},"members":[{"id":71269,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-hfvw-8x32-38cp","summary":"CGA-hfvw-8x32-38cp","evidence":"osv:CGA-hfvw-8x32-38cp","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hfvw-8x32-38cp","aliases":["CGA-hfvw-8x32-38cp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfvw-8x32-38cp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfvw-8x32-38cp.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-02T18:27:52.325915729Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:81aebb2d-f579-4a26-8d1e-3eec3b853350","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hfvw-8x32-38cp","advisory_id":"81aebb2d-f579-4a26-8d1e-3eec3b853350","event_types":["advisory"],"published_at":"2026-10-25T22:44:12.249472+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:57+00:00","detail_url":"/events/71269"}]}},{"id":70893,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-g5pf-frmr-wp9m","summary":"CGA-g5pf-frmr-wp9m","evidence":"osv:CGA-g5pf-frmr-wp9m","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g5pf-frmr-wp9m","aliases":["CGA-g5pf-frmr-wp9m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5pf-frmr-wp9m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5pf-frmr-wp9m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}}],"modified":"2026-10-02T18:27:51.390358416Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a8ce728b-8d5f-42c5-bd94-114f9af13bf3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g5pf-frmr-wp9m","advisory_id":"a8ce728b-8d5f-42c5-bd94-114f9af13bf3","event_types":["advisory"],"published_at":"2026-10-25T22:44:07.055329+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:52+00:00","detail_url":"/advisories/advisory%3Aa8ce728b-8d5f-42c5-bd94-114f9af13bf3","group":{"id":"advisory:a8ce728b-8d5f-42c5-bd94-114f9af13bf3","revision":1,"primary_event_id":71264,"change":"published","superseded_by":[],"changed":{"id":71264,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-g5pf-frmr-wp9m","summary":"CGA-g5pf-frmr-wp9m","evidence":"osv:CGA-g5pf-frmr-wp9m","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g5pf-frmr-wp9m","aliases":["CGA-g5pf-frmr-wp9m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5pf-frmr-wp9m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5pf-frmr-wp9m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}}],"modified":"2026-10-02T18:27:51.390358416Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a8ce728b-8d5f-42c5-bd94-114f9af13bf3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g5pf-frmr-wp9m","advisory_id":"a8ce728b-8d5f-42c5-bd94-114f9af13bf3","event_types":["advisory"],"published_at":"2026-10-25T22:44:07.055329+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:52+00:00","detail_url":"/events/71264"},"members":[{"id":71264,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-g5pf-frmr-wp9m","summary":"CGA-g5pf-frmr-wp9m","evidence":"osv:CGA-g5pf-frmr-wp9m","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g5pf-frmr-wp9m","aliases":["CGA-g5pf-frmr-wp9m"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5pf-frmr-wp9m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5pf-frmr-wp9m.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:26Z"}]}}],"modified":"2026-10-02T18:27:51.390358416Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a8ce728b-8d5f-42c5-bd94-114f9af13bf3","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g5pf-frmr-wp9m","advisory_id":"a8ce728b-8d5f-42c5-bd94-114f9af13bf3","event_types":["advisory"],"published_at":"2026-10-25T22:44:07.055329+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:52+00:00","detail_url":"/events/71264"}]}},{"id":70874,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-5458-j8xw-73qf","summary":"CGA-5458-j8xw-73qf","evidence":"osv:CGA-5458-j8xw-73qf","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5458-j8xw-73qf","aliases":["CGA-5458-j8xw-73qf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5458-j8xw-73qf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5458-j8xw-73qf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-02T18:27:45.474795675Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:757b4060-deb9-4718-9bb9-621ffd515fad","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5458-j8xw-73qf","advisory_id":"757b4060-deb9-4718-9bb9-621ffd515fad","event_types":["advisory"],"published_at":"2026-10-25T22:43:20.320121+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:50+00:00","detail_url":"/advisories/advisory%3A757b4060-deb9-4718-9bb9-621ffd515fad","group":{"id":"advisory:757b4060-deb9-4718-9bb9-621ffd515fad","revision":1,"primary_event_id":71245,"change":"published","superseded_by":[],"changed":{"id":71245,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-5458-j8xw-73qf","summary":"CGA-5458-j8xw-73qf","evidence":"osv:CGA-5458-j8xw-73qf","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5458-j8xw-73qf","aliases":["CGA-5458-j8xw-73qf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5458-j8xw-73qf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5458-j8xw-73qf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-02T18:27:45.474795675Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:757b4060-deb9-4718-9bb9-621ffd515fad","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5458-j8xw-73qf","advisory_id":"757b4060-deb9-4718-9bb9-621ffd515fad","event_types":["advisory"],"published_at":"2026-10-25T22:43:20.320121+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:50+00:00","detail_url":"/events/71245"},"members":[{"id":71245,"cve_ids":["CVE-2026-65959"],"payload":{"kind":"advisory","title":"CGA-5458-j8xw-73qf","summary":"CGA-5458-j8xw-73qf","evidence":"osv:CGA-5458-j8xw-73qf","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5458-j8xw-73qf","aliases":["CGA-5458-j8xw-73qf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5458-j8xw-73qf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5458-j8xw-73qf.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-02T18:27:45.474795675Z","provider":"osv","upstream":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m","GO-2026-6356"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[{"value":"CVE-2026-65959","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:757b4060-deb9-4718-9bb9-621ffd515fad","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5458-j8xw-73qf","advisory_id":"757b4060-deb9-4718-9bb9-621ffd515fad","event_types":["advisory"],"published_at":"2026-10-25T22:43:20.320121+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:50+00:00","detail_url":"/events/71245"}]}},{"id":65905,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-vgv4-hvjj-6pj5","summary":"CGA-vgv4-hvjj-6pj5","evidence":"osv:CGA-vgv4-hvjj-6pj5","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vgv4-hvjj-6pj5","aliases":["CGA-vgv4-hvjj-6pj5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgv4-hvjj-6pj5.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgv4-hvjj-6pj5.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}}],"modified":"2026-10-01T23:12:58.292882436Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:24730054-2c03-4359-ba6d-51a6aa573bae","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vgv4-hvjj-6pj5","advisory_id":"24730054-2c03-4359-ba6d-51a6aa573bae","event_types":["advisory"],"published_at":"2026-10-25T20:31:40.376235+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/advisories/advisory%3A24730054-2c03-4359-ba6d-51a6aa573bae","group":{"id":"advisory:24730054-2c03-4359-ba6d-51a6aa573bae","revision":1,"primary_event_id":65215,"change":"published","superseded_by":[],"changed":{"id":65215,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-vgv4-hvjj-6pj5","summary":"CGA-vgv4-hvjj-6pj5","evidence":"osv:CGA-vgv4-hvjj-6pj5","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vgv4-hvjj-6pj5","aliases":["CGA-vgv4-hvjj-6pj5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgv4-hvjj-6pj5.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgv4-hvjj-6pj5.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}}],"modified":"2026-10-01T23:12:58.292882436Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:24730054-2c03-4359-ba6d-51a6aa573bae","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vgv4-hvjj-6pj5","advisory_id":"24730054-2c03-4359-ba6d-51a6aa573bae","event_types":["advisory"],"published_at":"2026-10-25T20:31:40.376235+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/events/65215"},"members":[{"id":65215,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-vgv4-hvjj-6pj5","summary":"CGA-vgv4-hvjj-6pj5","evidence":"osv:CGA-vgv4-hvjj-6pj5","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vgv4-hvjj-6pj5","aliases":["CGA-vgv4-hvjj-6pj5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgv4-hvjj-6pj5.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vgv4-hvjj-6pj5.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtexplain","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}}],"modified":"2026-10-01T23:12:58.292882436Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:24730054-2c03-4359-ba6d-51a6aa573bae","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vgv4-hvjj-6pj5","advisory_id":"24730054-2c03-4359-ba6d-51a6aa573bae","event_types":["advisory"],"published_at":"2026-10-25T20:31:40.376235+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/events/65215"}]}},{"id":65901,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4c4g-g3hh-qq7h","summary":"CGA-4c4g-g3hh-qq7h","evidence":"osv:CGA-4c4g-g3hh-qq7h","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4c4g-g3hh-qq7h","aliases":["CGA-4c4g-g3hh-qq7h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4c4g-g3hh-qq7h.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4c4g-g3hh-qq7h.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-01T23:12:57.417438105Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:428971fd-a17e-4241-a981-ff7f928db641","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4c4g-g3hh-qq7h","advisory_id":"428971fd-a17e-4241-a981-ff7f928db641","event_types":["advisory"],"published_at":"2026-10-25T20:31:36.647974+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:58+00:00","detail_url":"/advisories/advisory%3A428971fd-a17e-4241-a981-ff7f928db641","group":{"id":"advisory:428971fd-a17e-4241-a981-ff7f928db641","revision":1,"primary_event_id":65211,"change":"published","superseded_by":[],"changed":{"id":65211,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4c4g-g3hh-qq7h","summary":"CGA-4c4g-g3hh-qq7h","evidence":"osv:CGA-4c4g-g3hh-qq7h","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4c4g-g3hh-qq7h","aliases":["CGA-4c4g-g3hh-qq7h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4c4g-g3hh-qq7h.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4c4g-g3hh-qq7h.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-01T23:12:57.417438105Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:428971fd-a17e-4241-a981-ff7f928db641","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4c4g-g3hh-qq7h","advisory_id":"428971fd-a17e-4241-a981-ff7f928db641","event_types":["advisory"],"published_at":"2026-10-25T20:31:36.647974+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:58+00:00","detail_url":"/events/65211"},"members":[{"id":65211,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-4c4g-g3hh-qq7h","summary":"CGA-4c4g-g3hh-qq7h","evidence":"osv:CGA-4c4g-g3hh-qq7h","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-4c4g-g3hh-qq7h","aliases":["CGA-4c4g-g3hh-qq7h"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4c4g-g3hh-qq7h.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4c4g-g3hh-qq7h.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-01T23:12:57.417438105Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:428971fd-a17e-4241-a981-ff7f928db641","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4c4g-g3hh-qq7h","advisory_id":"428971fd-a17e-4241-a981-ff7f928db641","event_types":["advisory"],"published_at":"2026-10-25T20:31:36.647974+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:58+00:00","detail_url":"/events/65211"}]}},{"id":65900,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c89w-gch7-mg97","summary":"CGA-c89w-gch7-mg97","evidence":"osv:CGA-c89w-gch7-mg97","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c89w-gch7-mg97","aliases":["CGA-c89w-gch7-mg97"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c89w-gch7-mg97.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c89w-gch7-mg97.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}}],"modified":"2026-10-01T23:12:57.355323421Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a389da13-1b12-468a-b3cd-5fbcd56cafeb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c89w-gch7-mg97","advisory_id":"a389da13-1b12-468a-b3cd-5fbcd56cafeb","event_types":["advisory"],"published_at":"2026-10-25T20:31:35.741765+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:34:00+00:00","detail_url":"/advisories/advisory%3Aa389da13-1b12-468a-b3cd-5fbcd56cafeb","group":{"id":"advisory:a389da13-1b12-468a-b3cd-5fbcd56cafeb","revision":1,"primary_event_id":65210,"change":"published","superseded_by":[],"changed":{"id":65210,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c89w-gch7-mg97","summary":"CGA-c89w-gch7-mg97","evidence":"osv:CGA-c89w-gch7-mg97","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c89w-gch7-mg97","aliases":["CGA-c89w-gch7-mg97"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c89w-gch7-mg97.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c89w-gch7-mg97.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}}],"modified":"2026-10-01T23:12:57.355323421Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a389da13-1b12-468a-b3cd-5fbcd56cafeb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c89w-gch7-mg97","advisory_id":"a389da13-1b12-468a-b3cd-5fbcd56cafeb","event_types":["advisory"],"published_at":"2026-10-25T20:31:35.741765+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:34:00+00:00","detail_url":"/events/65210"},"members":[{"id":65210,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-c89w-gch7-mg97","summary":"CGA-c89w-gch7-mg97","evidence":"osv:CGA-c89w-gch7-mg97","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-c89w-gch7-mg97","aliases":["CGA-c89w-gch7-mg97"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c89w-gch7-mg97.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c89w-gch7-mg97.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}}],"modified":"2026-10-01T23:12:57.355323421Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a389da13-1b12-468a-b3cd-5fbcd56cafeb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c89w-gch7-mg97","advisory_id":"a389da13-1b12-468a-b3cd-5fbcd56cafeb","event_types":["advisory"],"published_at":"2026-10-25T20:31:35.741765+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:34:00+00:00","detail_url":"/events/65210"}]}},{"id":65889,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m956-4mqx-cqwr","summary":"CGA-m956-4mqx-cqwr","evidence":"osv:CGA-m956-4mqx-cqwr","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m956-4mqx-cqwr","aliases":["CGA-m956-4mqx-cqwr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m956-4mqx-cqwr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m956-4mqx-cqwr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}}],"modified":"2026-10-01T23:12:55.289318442Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0cf85a62-ce61-4f3c-b919-600e2eef4db5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m956-4mqx-cqwr","advisory_id":"0cf85a62-ce61-4f3c-b919-600e2eef4db5","event_types":["advisory"],"published_at":"2026-10-25T20:31:27.090318+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:58+00:00","detail_url":"/advisories/advisory%3A0cf85a62-ce61-4f3c-b919-600e2eef4db5","group":{"id":"advisory:0cf85a62-ce61-4f3c-b919-600e2eef4db5","revision":1,"primary_event_id":65199,"change":"published","superseded_by":[],"changed":{"id":65199,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m956-4mqx-cqwr","summary":"CGA-m956-4mqx-cqwr","evidence":"osv:CGA-m956-4mqx-cqwr","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m956-4mqx-cqwr","aliases":["CGA-m956-4mqx-cqwr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m956-4mqx-cqwr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m956-4mqx-cqwr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}}],"modified":"2026-10-01T23:12:55.289318442Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0cf85a62-ce61-4f3c-b919-600e2eef4db5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m956-4mqx-cqwr","advisory_id":"0cf85a62-ce61-4f3c-b919-600e2eef4db5","event_types":["advisory"],"published_at":"2026-10-25T20:31:27.090318+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:58+00:00","detail_url":"/events/65199"},"members":[{"id":65199,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-m956-4mqx-cqwr","summary":"CGA-m956-4mqx-cqwr","evidence":"osv:CGA-m956-4mqx-cqwr","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-m956-4mqx-cqwr","aliases":["CGA-m956-4mqx-cqwr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m956-4mqx-cqwr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m956-4mqx-cqwr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtbackup","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:52Z"}]}}],"modified":"2026-10-01T23:12:55.289318442Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0cf85a62-ce61-4f3c-b919-600e2eef4db5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m956-4mqx-cqwr","advisory_id":"0cf85a62-ce61-4f3c-b919-600e2eef4db5","event_types":["advisory"],"published_at":"2026-10-25T20:31:27.090318+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:58+00:00","detail_url":"/events/65199"}]}},{"id":65888,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-r7rj-qrx3-q3qr","summary":"CGA-r7rj-qrx3-q3qr","evidence":"osv:CGA-r7rj-qrx3-q3qr","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-r7rj-qrx3-q3qr","aliases":["CGA-r7rj-qrx3-q3qr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r7rj-qrx3-q3qr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r7rj-qrx3-q3qr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}}],"modified":"2026-10-01T23:12:55.136047593Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bd4c172b-3b7f-4250-a36c-97ee4b2ee07e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r7rj-qrx3-q3qr","advisory_id":"bd4c172b-3b7f-4250-a36c-97ee4b2ee07e","event_types":["advisory"],"published_at":"2026-10-25T20:31:26.163487+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/advisories/advisory%3Abd4c172b-3b7f-4250-a36c-97ee4b2ee07e","group":{"id":"advisory:bd4c172b-3b7f-4250-a36c-97ee4b2ee07e","revision":1,"primary_event_id":65198,"change":"published","superseded_by":[],"changed":{"id":65198,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-r7rj-qrx3-q3qr","summary":"CGA-r7rj-qrx3-q3qr","evidence":"osv:CGA-r7rj-qrx3-q3qr","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-r7rj-qrx3-q3qr","aliases":["CGA-r7rj-qrx3-q3qr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r7rj-qrx3-q3qr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r7rj-qrx3-q3qr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}}],"modified":"2026-10-01T23:12:55.136047593Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bd4c172b-3b7f-4250-a36c-97ee4b2ee07e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r7rj-qrx3-q3qr","advisory_id":"bd4c172b-3b7f-4250-a36c-97ee4b2ee07e","event_types":["advisory"],"published_at":"2026-10-25T20:31:26.163487+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/events/65198"},"members":[{"id":65198,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-r7rj-qrx3-q3qr","summary":"CGA-r7rj-qrx3-q3qr","evidence":"osv:CGA-r7rj-qrx3-q3qr","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-r7rj-qrx3-q3qr","aliases":["CGA-r7rj-qrx3-q3qr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r7rj-qrx3-q3qr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r7rj-qrx3-q3qr.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}}],"modified":"2026-10-01T23:12:55.136047593Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bd4c172b-3b7f-4250-a36c-97ee4b2ee07e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r7rj-qrx3-q3qr","advisory_id":"bd4c172b-3b7f-4250-a36c-97ee4b2ee07e","event_types":["advisory"],"published_at":"2026-10-25T20:31:26.163487+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/events/65198"}]}},{"id":65883,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-76hx-rfhp-f5rm","summary":"CGA-76hx-rfhp-f5rm","evidence":"osv:CGA-76hx-rfhp-f5rm","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-76hx-rfhp-f5rm","aliases":["CGA-76hx-rfhp-f5rm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-76hx-rfhp-f5rm.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-76hx-rfhp-f5rm.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-01T23:12:53.040176652Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2d29ea6c-af03-4315-a4b8-82a8ab9f8b92","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-76hx-rfhp-f5rm","advisory_id":"2d29ea6c-af03-4315-a4b8-82a8ab9f8b92","event_types":["advisory"],"published_at":"2026-10-25T20:31:22.562904+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:54+00:00","detail_url":"/advisories/advisory%3A2d29ea6c-af03-4315-a4b8-82a8ab9f8b92","group":{"id":"advisory:2d29ea6c-af03-4315-a4b8-82a8ab9f8b92","revision":1,"primary_event_id":65193,"change":"published","superseded_by":[],"changed":{"id":65193,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-76hx-rfhp-f5rm","summary":"CGA-76hx-rfhp-f5rm","evidence":"osv:CGA-76hx-rfhp-f5rm","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-76hx-rfhp-f5rm","aliases":["CGA-76hx-rfhp-f5rm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-76hx-rfhp-f5rm.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-76hx-rfhp-f5rm.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-01T23:12:53.040176652Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2d29ea6c-af03-4315-a4b8-82a8ab9f8b92","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-76hx-rfhp-f5rm","advisory_id":"2d29ea6c-af03-4315-a4b8-82a8ab9f8b92","event_types":["advisory"],"published_at":"2026-10-25T20:31:22.562904+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:54+00:00","detail_url":"/events/65193"},"members":[{"id":65193,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-76hx-rfhp-f5rm","summary":"CGA-76hx-rfhp-f5rm","evidence":"osv:CGA-76hx-rfhp-f5rm","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-76hx-rfhp-f5rm","aliases":["CGA-76hx-rfhp-f5rm"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-76hx-rfhp-f5rm.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-76hx-rfhp-f5rm.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-01T23:12:53.040176652Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2d29ea6c-af03-4315-a4b8-82a8ab9f8b92","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-76hx-rfhp-f5rm","advisory_id":"2d29ea6c-af03-4315-a4b8-82a8ab9f8b92","event_types":["advisory"],"published_at":"2026-10-25T20:31:22.562904+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:54+00:00","detail_url":"/events/65193"}]}},{"id":65879,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-fc2h-2ggp-g3h3","summary":"CGA-fc2h-2ggp-g3h3","evidence":"osv:CGA-fc2h-2ggp-g3h3","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-fc2h-2ggp-g3h3","aliases":["CGA-fc2h-2ggp-g3h3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fc2h-2ggp-g3h3.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fc2h-2ggp-g3h3.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-01T23:12:51.857195479Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b9c17f3-78c6-49bc-8582-54e78c7fc6d9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fc2h-2ggp-g3h3","advisory_id":"1b9c17f3-78c6-49bc-8582-54e78c7fc6d9","event_types":["advisory"],"published_at":"2026-10-25T20:31:19.04803+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:57+00:00","detail_url":"/advisories/advisory%3A1b9c17f3-78c6-49bc-8582-54e78c7fc6d9","group":{"id":"advisory:1b9c17f3-78c6-49bc-8582-54e78c7fc6d9","revision":1,"primary_event_id":65189,"change":"published","superseded_by":[],"changed":{"id":65189,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-fc2h-2ggp-g3h3","summary":"CGA-fc2h-2ggp-g3h3","evidence":"osv:CGA-fc2h-2ggp-g3h3","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-fc2h-2ggp-g3h3","aliases":["CGA-fc2h-2ggp-g3h3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fc2h-2ggp-g3h3.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fc2h-2ggp-g3h3.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-01T23:12:51.857195479Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b9c17f3-78c6-49bc-8582-54e78c7fc6d9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fc2h-2ggp-g3h3","advisory_id":"1b9c17f3-78c6-49bc-8582-54e78c7fc6d9","event_types":["advisory"],"published_at":"2026-10-25T20:31:19.04803+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:57+00:00","detail_url":"/events/65189"},"members":[{"id":65189,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-fc2h-2ggp-g3h3","summary":"CGA-fc2h-2ggp-g3h3","evidence":"osv:CGA-fc2h-2ggp-g3h3","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-fc2h-2ggp-g3h3","aliases":["CGA-fc2h-2ggp-g3h3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fc2h-2ggp-g3h3.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-fc2h-2ggp-g3h3.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:53Z"}]}}],"modified":"2026-10-01T23:12:51.857195479Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b9c17f3-78c6-49bc-8582-54e78c7fc6d9","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-fc2h-2ggp-g3h3","advisory_id":"1b9c17f3-78c6-49bc-8582-54e78c7fc6d9","event_types":["advisory"],"published_at":"2026-10-25T20:31:19.04803+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:57+00:00","detail_url":"/events/65189"}]}},{"id":65869,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-g9jg-xx6f-rmqh","summary":"CGA-g9jg-xx6f-rmqh","evidence":"osv:CGA-g9jg-xx6f-rmqh","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g9jg-xx6f-rmqh","aliases":["CGA-g9jg-xx6f-rmqh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g9jg-xx6f-rmqh.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g9jg-xx6f-rmqh.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-01T23:12:49.845617404Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3cd3780c-0e48-41fd-8571-cbdd038d4fc0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g9jg-xx6f-rmqh","advisory_id":"3cd3780c-0e48-41fd-8571-cbdd038d4fc0","event_types":["advisory"],"published_at":"2026-10-25T20:30:23.168156+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:52+00:00","detail_url":"/advisories/advisory%3A3cd3780c-0e48-41fd-8571-cbdd038d4fc0","group":{"id":"advisory:3cd3780c-0e48-41fd-8571-cbdd038d4fc0","revision":1,"primary_event_id":65179,"change":"published","superseded_by":[],"changed":{"id":65179,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-g9jg-xx6f-rmqh","summary":"CGA-g9jg-xx6f-rmqh","evidence":"osv:CGA-g9jg-xx6f-rmqh","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g9jg-xx6f-rmqh","aliases":["CGA-g9jg-xx6f-rmqh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g9jg-xx6f-rmqh.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g9jg-xx6f-rmqh.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-01T23:12:49.845617404Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3cd3780c-0e48-41fd-8571-cbdd038d4fc0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g9jg-xx6f-rmqh","advisory_id":"3cd3780c-0e48-41fd-8571-cbdd038d4fc0","event_types":["advisory"],"published_at":"2026-10-25T20:30:23.168156+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:52+00:00","detail_url":"/events/65179"},"members":[{"id":65179,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-g9jg-xx6f-rmqh","summary":"CGA-g9jg-xx6f-rmqh","evidence":"osv:CGA-g9jg-xx6f-rmqh","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g9jg-xx6f-rmqh","aliases":["CGA-g9jg-xx6f-rmqh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g9jg-xx6f-rmqh.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g9jg-xx6f-rmqh.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctl","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:25Z"}]}}],"modified":"2026-10-01T23:12:49.845617404Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3cd3780c-0e48-41fd-8571-cbdd038d4fc0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g9jg-xx6f-rmqh","advisory_id":"3cd3780c-0e48-41fd-8571-cbdd038d4fc0","event_types":["advisory"],"published_at":"2026-10-25T20:30:23.168156+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:52+00:00","detail_url":"/events/65179"}]}},{"id":65868,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2hg9-x24c-r27c","summary":"CGA-2hg9-x24c-r27c","evidence":"osv:CGA-2hg9-x24c-r27c","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2hg9-x24c-r27c","aliases":["CGA-2hg9-x24c-r27c"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2hg9-x24c-r27c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2hg9-x24c-r27c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}}],"modified":"2026-10-01T23:12:49.567360013Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:69c77f59-d620-41ff-99f0-e613af8dfb3c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2hg9-x24c-r27c","advisory_id":"69c77f59-d620-41ff-99f0-e613af8dfb3c","event_types":["advisory"],"published_at":"2026-10-25T20:30:22.189698+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:55+00:00","detail_url":"/advisories/advisory%3A69c77f59-d620-41ff-99f0-e613af8dfb3c","group":{"id":"advisory:69c77f59-d620-41ff-99f0-e613af8dfb3c","revision":1,"primary_event_id":65178,"change":"published","superseded_by":[],"changed":{"id":65178,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2hg9-x24c-r27c","summary":"CGA-2hg9-x24c-r27c","evidence":"osv:CGA-2hg9-x24c-r27c","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2hg9-x24c-r27c","aliases":["CGA-2hg9-x24c-r27c"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2hg9-x24c-r27c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2hg9-x24c-r27c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}}],"modified":"2026-10-01T23:12:49.567360013Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:69c77f59-d620-41ff-99f0-e613af8dfb3c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2hg9-x24c-r27c","advisory_id":"69c77f59-d620-41ff-99f0-e613af8dfb3c","event_types":["advisory"],"published_at":"2026-10-25T20:30:22.189698+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:55+00:00","detail_url":"/events/65178"},"members":[{"id":65178,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-2hg9-x24c-r27c","summary":"CGA-2hg9-x24c-r27c","evidence":"osv:CGA-2hg9-x24c-r27c","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2hg9-x24c-r27c","aliases":["CGA-2hg9-x24c-r27c"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2hg9-x24c-r27c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2hg9-x24c-r27c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}}],"modified":"2026-10-01T23:12:49.567360013Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:69c77f59-d620-41ff-99f0-e613af8dfb3c","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-2hg9-x24c-r27c","advisory_id":"69c77f59-d620-41ff-99f0-e613af8dfb3c","event_types":["advisory"],"published_at":"2026-10-25T20:30:22.189698+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:55+00:00","detail_url":"/events/65178"}]}},{"id":65867,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p67h-wxrw-h942","summary":"CGA-p67h-wxrw-h942","evidence":"osv:CGA-p67h-wxrw-h942","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p67h-wxrw-h942","aliases":["CGA-p67h-wxrw-h942"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p67h-wxrw-h942.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p67h-wxrw-h942.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}}],"modified":"2026-10-01T23:12:49.385842676Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1ca98666-09e2-4b41-9874-fd9c6fd74dcb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p67h-wxrw-h942","advisory_id":"1ca98666-09e2-4b41-9874-fd9c6fd74dcb","event_types":["advisory"],"published_at":"2026-10-25T20:30:21.414723+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/advisories/advisory%3A1ca98666-09e2-4b41-9874-fd9c6fd74dcb","group":{"id":"advisory:1ca98666-09e2-4b41-9874-fd9c6fd74dcb","revision":1,"primary_event_id":65177,"change":"published","superseded_by":[],"changed":{"id":65177,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p67h-wxrw-h942","summary":"CGA-p67h-wxrw-h942","evidence":"osv:CGA-p67h-wxrw-h942","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p67h-wxrw-h942","aliases":["CGA-p67h-wxrw-h942"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p67h-wxrw-h942.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p67h-wxrw-h942.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}}],"modified":"2026-10-01T23:12:49.385842676Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1ca98666-09e2-4b41-9874-fd9c6fd74dcb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p67h-wxrw-h942","advisory_id":"1ca98666-09e2-4b41-9874-fd9c6fd74dcb","event_types":["advisory"],"published_at":"2026-10-25T20:30:21.414723+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/events/65177"},"members":[{"id":65177,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p67h-wxrw-h942","summary":"CGA-p67h-wxrw-h942","evidence":"osv:CGA-p67h-wxrw-h942","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p67h-wxrw-h942","aliases":["CGA-p67h-wxrw-h942"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p67h-wxrw-h942.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p67h-wxrw-h942.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtgate","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}}],"modified":"2026-10-01T23:12:49.385842676Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1ca98666-09e2-4b41-9874-fd9c6fd74dcb","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p67h-wxrw-h942","advisory_id":"1ca98666-09e2-4b41-9874-fd9c6fd74dcb","event_types":["advisory"],"published_at":"2026-10-25T20:30:21.414723+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/events/65177"}]}},{"id":65862,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-jm4q-hg4p-wxgj","summary":"CGA-jm4q-hg4p-wxgj","evidence":"osv:CGA-jm4q-hg4p-wxgj","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-jm4q-hg4p-wxgj","aliases":["CGA-jm4q-hg4p-wxgj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jm4q-hg4p-wxgj.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jm4q-hg4p-wxgj.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}}],"modified":"2026-10-01T23:12:48.109586816Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a52536ce-fd9e-4d6f-b390-135fd2312d01","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jm4q-hg4p-wxgj","advisory_id":"a52536ce-fd9e-4d6f-b390-135fd2312d01","event_types":["advisory"],"published_at":"2026-10-25T20:30:17.219872+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:51+00:00","detail_url":"/advisories/advisory%3Aa52536ce-fd9e-4d6f-b390-135fd2312d01","group":{"id":"advisory:a52536ce-fd9e-4d6f-b390-135fd2312d01","revision":1,"primary_event_id":65172,"change":"published","superseded_by":[],"changed":{"id":65172,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-jm4q-hg4p-wxgj","summary":"CGA-jm4q-hg4p-wxgj","evidence":"osv:CGA-jm4q-hg4p-wxgj","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-jm4q-hg4p-wxgj","aliases":["CGA-jm4q-hg4p-wxgj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jm4q-hg4p-wxgj.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jm4q-hg4p-wxgj.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}}],"modified":"2026-10-01T23:12:48.109586816Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a52536ce-fd9e-4d6f-b390-135fd2312d01","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jm4q-hg4p-wxgj","advisory_id":"a52536ce-fd9e-4d6f-b390-135fd2312d01","event_types":["advisory"],"published_at":"2026-10-25T20:30:17.219872+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:51+00:00","detail_url":"/events/65172"},"members":[{"id":65172,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-jm4q-hg4p-wxgj","summary":"CGA-jm4q-hg4p-wxgj","evidence":"osv:CGA-jm4q-hg4p-wxgj","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-jm4q-hg4p-wxgj","aliases":["CGA-jm4q-hg4p-wxgj"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jm4q-hg4p-wxgj.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jm4q-hg4p-wxgj.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/mysqlctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}}],"modified":"2026-10-01T23:12:48.109586816Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:a52536ce-fd9e-4d6f-b390-135fd2312d01","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-jm4q-hg4p-wxgj","advisory_id":"a52536ce-fd9e-4d6f-b390-135fd2312d01","event_types":["advisory"],"published_at":"2026-10-25T20:30:17.219872+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:51+00:00","detail_url":"/events/65172"}]}},{"id":65861,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p86w-8h9h-cr4r","summary":"CGA-p86w-8h9h-cr4r","evidence":"osv:CGA-p86w-8h9h-cr4r","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p86w-8h9h-cr4r","aliases":["CGA-p86w-8h9h-cr4r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p86w-8h9h-cr4r.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p86w-8h9h-cr4r.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}}],"modified":"2026-10-01T23:12:47.753754567Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d2701177-ea86-4dbd-b293-f334b4f64df5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p86w-8h9h-cr4r","advisory_id":"d2701177-ea86-4dbd-b293-f334b4f64df5","event_types":["advisory"],"published_at":"2026-10-25T20:30:16.043447+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:34:00+00:00","detail_url":"/advisories/advisory%3Ad2701177-ea86-4dbd-b293-f334b4f64df5","group":{"id":"advisory:d2701177-ea86-4dbd-b293-f334b4f64df5","revision":1,"primary_event_id":65171,"change":"published","superseded_by":[],"changed":{"id":65171,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p86w-8h9h-cr4r","summary":"CGA-p86w-8h9h-cr4r","evidence":"osv:CGA-p86w-8h9h-cr4r","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p86w-8h9h-cr4r","aliases":["CGA-p86w-8h9h-cr4r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p86w-8h9h-cr4r.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p86w-8h9h-cr4r.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}}],"modified":"2026-10-01T23:12:47.753754567Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d2701177-ea86-4dbd-b293-f334b4f64df5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p86w-8h9h-cr4r","advisory_id":"d2701177-ea86-4dbd-b293-f334b4f64df5","event_types":["advisory"],"published_at":"2026-10-25T20:30:16.043447+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:34:00+00:00","detail_url":"/events/65171"},"members":[{"id":65171,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-p86w-8h9h-cr4r","summary":"CGA-p86w-8h9h-cr4r","evidence":"osv:CGA-p86w-8h9h-cr4r","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-p86w-8h9h-cr4r","aliases":["CGA-p86w-8h9h-cr4r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p86w-8h9h-cr4r.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-p86w-8h9h-cr4r.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtorc","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:55Z"}]}}],"modified":"2026-10-01T23:12:47.753754567Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d2701177-ea86-4dbd-b293-f334b4f64df5","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-p86w-8h9h-cr4r","advisory_id":"d2701177-ea86-4dbd-b293-f334b4f64df5","event_types":["advisory"],"published_at":"2026-10-25T20:30:16.043447+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:34:00+00:00","detail_url":"/events/65171"}]}},{"id":65856,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-mgrw-p33j-7w6c","summary":"CGA-mgrw-p33j-7w6c","evidence":"osv:CGA-mgrw-p33j-7w6c","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mgrw-p33j-7w6c","aliases":["CGA-mgrw-p33j-7w6c"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mgrw-p33j-7w6c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mgrw-p33j-7w6c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}}],"modified":"2026-10-01T23:12:46.925515270Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e449e71c-d6ae-48f6-910c-d3e1f0aaa547","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mgrw-p33j-7w6c","advisory_id":"e449e71c-d6ae-48f6-910c-d3e1f0aaa547","event_types":["advisory"],"published_at":"2026-10-25T20:30:11.463931+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:56+00:00","detail_url":"/advisories/advisory%3Ae449e71c-d6ae-48f6-910c-d3e1f0aaa547","group":{"id":"advisory:e449e71c-d6ae-48f6-910c-d3e1f0aaa547","revision":1,"primary_event_id":65166,"change":"published","superseded_by":[],"changed":{"id":65166,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-mgrw-p33j-7w6c","summary":"CGA-mgrw-p33j-7w6c","evidence":"osv:CGA-mgrw-p33j-7w6c","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mgrw-p33j-7w6c","aliases":["CGA-mgrw-p33j-7w6c"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mgrw-p33j-7w6c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mgrw-p33j-7w6c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}}],"modified":"2026-10-01T23:12:46.925515270Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e449e71c-d6ae-48f6-910c-d3e1f0aaa547","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mgrw-p33j-7w6c","advisory_id":"e449e71c-d6ae-48f6-910c-d3e1f0aaa547","event_types":["advisory"],"published_at":"2026-10-25T20:30:11.463931+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:56+00:00","detail_url":"/events/65166"},"members":[{"id":65166,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-mgrw-p33j-7w6c","summary":"CGA-mgrw-p33j-7w6c","evidence":"osv:CGA-mgrw-p33j-7w6c","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-mgrw-p33j-7w6c","aliases":["CGA-mgrw-p33j-7w6c"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mgrw-p33j-7w6c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mgrw-p33j-7w6c.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vttablet","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}}],"modified":"2026-10-01T23:12:46.925515270Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e449e71c-d6ae-48f6-910c-d3e1f0aaa547","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mgrw-p33j-7w6c","advisory_id":"e449e71c-d6ae-48f6-910c-d3e1f0aaa547","event_types":["advisory"],"published_at":"2026-10-25T20:30:11.463931+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:56+00:00","detail_url":"/events/65166"}]}},{"id":65855,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-hx92-fv48-cw7q","summary":"CGA-hx92-fv48-cw7q","evidence":"osv:CGA-hx92-fv48-cw7q","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-hx92-fv48-cw7q","aliases":["CGA-hx92-fv48-cw7q"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hx92-fv48-cw7q.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hx92-fv48-cw7q.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}}],"modified":"2026-10-01T23:12:46.849465689Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c3c4c98c-f0be-4c50-9abc-f022b61aadee","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hx92-fv48-cw7q","advisory_id":"c3c4c98c-f0be-4c50-9abc-f022b61aadee","event_types":["advisory"],"published_at":"2026-10-25T20:30:10.804158+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/advisories/advisory%3Ac3c4c98c-f0be-4c50-9abc-f022b61aadee","group":{"id":"advisory:c3c4c98c-f0be-4c50-9abc-f022b61aadee","revision":1,"primary_event_id":65165,"change":"published","superseded_by":[],"changed":{"id":65165,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-hx92-fv48-cw7q","summary":"CGA-hx92-fv48-cw7q","evidence":"osv:CGA-hx92-fv48-cw7q","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-hx92-fv48-cw7q","aliases":["CGA-hx92-fv48-cw7q"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hx92-fv48-cw7q.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hx92-fv48-cw7q.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}}],"modified":"2026-10-01T23:12:46.849465689Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c3c4c98c-f0be-4c50-9abc-f022b61aadee","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hx92-fv48-cw7q","advisory_id":"c3c4c98c-f0be-4c50-9abc-f022b61aadee","event_types":["advisory"],"published_at":"2026-10-25T20:30:10.804158+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/events/65165"},"members":[{"id":65165,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-hx92-fv48-cw7q","summary":"CGA-hx92-fv48-cw7q","evidence":"osv:CGA-hx92-fv48-cw7q","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-hx92-fv48-cw7q","aliases":["CGA-hx92-fv48-cw7q"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hx92-fv48-cw7q.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hx92-fv48-cw7q.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctldclient","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:23:54Z"}]}}],"modified":"2026-10-01T23:12:46.849465689Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c3c4c98c-f0be-4c50-9abc-f022b61aadee","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hx92-fv48-cw7q","advisory_id":"c3c4c98c-f0be-4c50-9abc-f022b61aadee","event_types":["advisory"],"published_at":"2026-10-25T20:30:10.804158+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T12:33:59+00:00","detail_url":"/events/65165"}]}},{"id":65853,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-cf25-56j8-76rg","summary":"CGA-cf25-56j8-76rg","evidence":"osv:CGA-cf25-56j8-76rg","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-cf25-56j8-76rg","aliases":["CGA-cf25-56j8-76rg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf25-56j8-76rg.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf25-56j8-76rg.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}}],"modified":"2026-10-01T23:12:46.751041495Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e1294a5b-7987-4eef-8607-e181189595ba","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cf25-56j8-76rg","advisory_id":"e1294a5b-7987-4eef-8607-e181189595ba","event_types":["advisory"],"published_at":"2026-10-25T20:30:09.1691+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:53+00:00","detail_url":"/advisories/advisory%3Ae1294a5b-7987-4eef-8607-e181189595ba","group":{"id":"advisory:e1294a5b-7987-4eef-8607-e181189595ba","revision":1,"primary_event_id":65163,"change":"published","superseded_by":[],"changed":{"id":65163,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-cf25-56j8-76rg","summary":"CGA-cf25-56j8-76rg","evidence":"osv:CGA-cf25-56j8-76rg","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-cf25-56j8-76rg","aliases":["CGA-cf25-56j8-76rg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf25-56j8-76rg.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf25-56j8-76rg.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}}],"modified":"2026-10-01T23:12:46.751041495Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e1294a5b-7987-4eef-8607-e181189595ba","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cf25-56j8-76rg","advisory_id":"e1294a5b-7987-4eef-8607-e181189595ba","event_types":["advisory"],"published_at":"2026-10-25T20:30:09.1691+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:53+00:00","detail_url":"/events/65163"},"members":[{"id":65163,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-cf25-56j8-76rg","summary":"CGA-cf25-56j8-76rg","evidence":"osv:CGA-cf25-56j8-76rg","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-cf25-56j8-76rg","aliases":["CGA-cf25-56j8-76rg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf25-56j8-76rg.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cf25-56j8-76rg.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtctld","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:24Z"}]}}],"modified":"2026-10-01T23:12:46.751041495Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e1294a5b-7987-4eef-8607-e181189595ba","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cf25-56j8-76rg","advisory_id":"e1294a5b-7987-4eef-8607-e181189595ba","event_types":["advisory"],"published_at":"2026-10-25T20:30:09.1691+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:53+00:00","detail_url":"/events/65163"}]}},{"id":65849,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5p4g-hw7c-g38p","summary":"CGA-5p4g-hw7c-g38p","evidence":"osv:CGA-5p4g-hw7c-g38p","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5p4g-hw7c-g38p","aliases":["CGA-5p4g-hw7c-g38p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5p4g-hw7c-g38p.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5p4g-hw7c-g38p.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}}],"modified":"2026-10-01T23:12:45.298466642Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b437c2c9-36c4-48d1-9802-fc7714d42b42","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5p4g-hw7c-g38p","advisory_id":"b437c2c9-36c4-48d1-9802-fc7714d42b42","event_types":["advisory"],"published_at":"2026-10-25T20:30:05.615359+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:51+00:00","detail_url":"/advisories/advisory%3Ab437c2c9-36c4-48d1-9802-fc7714d42b42","group":{"id":"advisory:b437c2c9-36c4-48d1-9802-fc7714d42b42","revision":1,"primary_event_id":65159,"change":"published","superseded_by":[],"changed":{"id":65159,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5p4g-hw7c-g38p","summary":"CGA-5p4g-hw7c-g38p","evidence":"osv:CGA-5p4g-hw7c-g38p","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5p4g-hw7c-g38p","aliases":["CGA-5p4g-hw7c-g38p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5p4g-hw7c-g38p.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5p4g-hw7c-g38p.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}}],"modified":"2026-10-01T23:12:45.298466642Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b437c2c9-36c4-48d1-9802-fc7714d42b42","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5p4g-hw7c-g38p","advisory_id":"b437c2c9-36c4-48d1-9802-fc7714d42b42","event_types":["advisory"],"published_at":"2026-10-25T20:30:05.615359+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:51+00:00","detail_url":"/events/65159"},"members":[{"id":65159,"cve_ids":[],"payload":{"kind":"advisory","title":"CGA-5p4g-hw7c-g38p","summary":"CGA-5p4g-hw7c-g38p","evidence":"osv:CGA-5p4g-hw7c-g38p","products":[{"name":{"value":"vitess-23","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"vitess-23","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"23.0.7-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-5p4g-hw7c-g38p","aliases":["CGA-5p4g-hw7c-g38p"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/chainguard/vitess-23?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5p4g-hw7c-g38p.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.7-r0"}]}],"package":{"name":"vitess-23","purl":"pkg:apk/wolfi/vitess-23?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5p4g-hw7c-g38p.json"},"ecosystem_specific":{"components":[{"component_name":"vitess.io/vitess","component_purl":"pkg:golang/vitess.io/vitess@v0.23.6%2Bdirty","component_type":"go-module","component_version":"v0.23.6+dirty","component_location":"/usr/bin/vtadmin","latest_event_status":"fixed","latest_event_timestamp":"2026-10-01T20:35:27Z"}]}}],"modified":"2026-10-01T23:12:45.298466642Z","provider":"osv","references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b437c2c9-36c4-48d1-9802-fc7714d42b42","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5p4g-hw7c-g38p","advisory_id":"b437c2c9-36c4-48d1-9802-fc7714d42b42","event_types":["advisory"],"published_at":"2026-10-25T20:30:05.615359+00:00","technologies":["core-osv","vitess-23"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-04T11:21:51+00:00","detail_url":"/events/65159"}]}}],"next_after":70941,"next_before":65849}