{"schema_version":"1","data":[{"id":"a3735554475f86aee30ab0e9e8387a8b42f85224d883d79fbc6481b5d643abca","cvss":null,"kind":"advisory","title":"CGA-2659-47ww-hvww","active":true,"cursor":79127,"cve_ids":[],"records":[{"id":"579611fdf0b74a021dc41470678938cac0a55d7a3ca0242fd74377be34814cb1","url":"https://osv.dev/vulnerability/CGA-2659-47ww-hvww","method":"structured","payload":{"kind":"advisory","title":"CGA-2659-47ww-hvww","summary":"CGA-2659-47ww-hvww","evidence":"osv:CGA-2659-47ww-hvww","products":[{"name":{"value":"wazuh-dashboard-dashboards-notifications-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-2659-47ww-hvww","aliases":["CGA-2659-47ww-hvww"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r6"}]}],"package":{"name":"wazuh-dashboard-dashboards-notifications-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-notifications-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2659-47ww-hvww.json"},"ecosystem_specific":{"components":[{"component_name":"dompurify","component_purl":"pkg:npm/dompurify@3.4.13","component_type":"npm","component_version":"3.4.13","component_location":"/usr/share/wazuh-dashboard/plugins/notificationsDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-06T13:18:12Z"}]}}],"modified":"2026-10-06T17:45:06.277986571Z","provider":"osv","upstream":["GHSA-6688-9rhm-gjv2"],"references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"source_id":"core-osv","document_id":89694,"published_at":"2026-10-06T11:37:46+00:00"}],"summary":"CGA-2659-47ww-hvww","revision":1,"severity":"unknown","important":true,"created_at":"2026-10-27T13:58:29.007+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:58:29.007+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-2659-47ww-hvww"],"fix_available":true,"fixed_cve_ids":[],"product_names":["wazuh-dashboard-dashboards-notifications-fips"],"fixed_versions":["4.14.8-r6"],"technology_ids":["core-osv","wazuh-dashboard-dashboards-notifications-fips"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-06T11:37:46+00:00"},{"id":"58d1e44f4ec6fa63b9543042f501a9a657ea5fec02ec90350e6a6f2a578bc420","cvss":null,"kind":"advisory","title":"CGA-237p-83w4-53j4","active":true,"cursor":79126,"cve_ids":[],"records":[{"id":"1cb3e28193d46521084a26d85835af85dc3822ca5e41dd6ebba94a20fa46d97a","url":"https://osv.dev/vulnerability/CGA-237p-83w4-53j4","method":"structured","payload":{"kind":"advisory","title":"CGA-237p-83w4-53j4","summary":"CGA-237p-83w4-53j4","evidence":"osv:CGA-237p-83w4-53j4","products":[{"name":{"value":"wazuh-dashboard-alerting-dashboards-plugin","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-237p-83w4-53j4","aliases":["CGA-237p-83w4-53j4"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r6"}]}],"package":{"name":"wazuh-dashboard-alerting-dashboards-plugin","purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-237p-83w4-53j4.json"},"ecosystem_specific":{"components":[{"component_name":"dompurify","component_purl":"pkg:npm/dompurify@3.4.13","component_type":"npm","component_version":"3.4.13","component_location":"/usr/share/wazuh-dashboard/plugins/alertingDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-06T13:30:42Z"}]}}],"modified":"2026-10-06T17:45:06.181485434Z","provider":"osv","upstream":["GHSA-6688-9rhm-gjv2"],"references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"source_id":"core-osv","document_id":89693,"published_at":"2026-10-06T12:16:08+00:00"}],"summary":"CGA-237p-83w4-53j4","revision":1,"severity":"unknown","important":true,"created_at":"2026-10-27T13:58:29.02+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:58:29.02+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-237p-83w4-53j4"],"fix_available":true,"fixed_cve_ids":[],"product_names":["wazuh-dashboard-alerting-dashboards-plugin"],"fixed_versions":["4.14.8-r6"],"technology_ids":["core-osv","wazuh-dashboard-alerting-dashboards-plugin"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-06T12:16:08+00:00"},{"id":"2cc60995c403725e156fcfe6aa7e58bceaacd6b963b7d96739c6243ecdc24868","cvss":null,"kind":"advisory","title":"CGA-267p-6x3c-fwq2","active":true,"cursor":79125,"cve_ids":["CVE-2026-95297"],"records":[{"id":"4d75a986cbc62d3e18601b5256efd83bfca18b972982017030bf5931e53aa53a","url":"https://osv.dev/vulnerability/CGA-267p-6x3c-fwq2","method":"structured","payload":{"kind":"advisory","title":"CGA-267p-6x3c-fwq2","summary":"CGA-267p-6x3c-fwq2","evidence":"osv:CGA-267p-6x3c-fwq2","products":[{"name":{"value":"chromium-lang","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"154.0.8037.92-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"chromium-lang","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"154.0.8037.92-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-267p-6x3c-fwq2","aliases":["CGA-267p-6x3c-fwq2"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"154.0.8037.92-r0"}]}],"package":{"name":"chromium-lang","purl":"pkg:apk/chainguard/chromium-lang?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-267p-6x3c-fwq2.json"},"ecosystem_specific":{"components":[{"component_name":"chromium-lang","component_purl":"pkg:apk/chromium-lang@153.0.8010.52-r2","component_type":"apk","component_version":"153.0.8010.52-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-06T14:28:23Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"154.0.8037.92-r0"}]}],"package":{"name":"chromium-lang","purl":"pkg:apk/wolfi/chromium-lang?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-267p-6x3c-fwq2.json"},"ecosystem_specific":{"components":[{"component_name":"chromium-lang","component_purl":"pkg:apk/chromium-lang@153.0.8010.52-r2","component_type":"apk","component_version":"153.0.8010.52-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-06T14:28:23Z"}]}}],"modified":"2026-10-06T17:45:06.161432192Z","provider":"osv","upstream":["CVE-2026-95297","GHSA-v39p-rpmc-r9xq"],"references":[]},"related_cves":[{"value":"CVE-2026-95297","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"source_id":"core-osv","document_id":89692,"published_at":"2026-10-02T16:37:16+00:00"}],"summary":"CGA-267p-6x3c-fwq2","revision":1,"severity":"unknown","important":true,"created_at":"2026-10-27T13:58:01.476+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:58:01.476+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-267p-6x3c-fwq2"],"fix_available":true,"fixed_cve_ids":[],"product_names":["chromium-lang"],"fixed_versions":["154.0.8037.92-r0"],"technology_ids":["chromium-lang","core-osv"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-02T16:37:16+00:00"},{"id":"f7708f752b7745edaed657379933f417c0c7a3b01dc6e9f693ddac37e251dd0a","cvss":{"score":2.3,"source":"CGA-22j8-mjpc-v568","version":"4.0"},"kind":"advisory","title":"CGA-22j8-mjpc-v568","active":true,"cursor":79124,"cve_ids":["CVE-2026-93981"],"records":[{"id":"4e0945866445db7775a9960d1e160cc5e72ee818dcb798b160f0c6738f792428","url":"https://osv.dev/vulnerability/CGA-22j8-mjpc-v568","method":"structured","payload":{"kind":"advisory","title":"CGA-22j8-mjpc-v568","summary":"CGA-22j8-mjpc-v568","evidence":"osv:CGA-22j8-mjpc-v568","products":[{"name":{"value":"wazuh-dashboard-alerting-dashboards-plugin","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"CGA-22j8-mjpc-v568","aliases":["CGA-22j8-mjpc-v568"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r6"}]}],"package":{"name":"wazuh-dashboard-alerting-dashboards-plugin","purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-22j8-mjpc-v568.json"},"ecosystem_specific":{"components":[{"component_name":"hono","component_purl":"pkg:npm/hono@4.13.5","component_type":"npm","component_version":"4.13.5","component_location":"/usr/share/wazuh-dashboard/plugins/alertingDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-06T13:10:24Z"}]}}],"modified":"2026-10-06T17:45:05.238353382Z","provider":"osv","upstream":["CVE-2026-93981","GHSA-6623-4q32-82v8","GHSA-hxh3-vqpv-xpqv"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93981.json","https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"]},"related_cves":[{"value":"CVE-2026-93981","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89690,"published_at":"2026-10-01T10:13:09+00:00"}],"summary":"CGA-22j8-mjpc-v568","revision":1,"severity":"low","important":false,"created_at":"2026-10-27T13:57:43.34+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:57:43.34+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-22j8-mjpc-v568"],"fix_available":true,"fixed_cve_ids":[],"product_names":["wazuh-dashboard-alerting-dashboards-plugin"],"fixed_versions":["4.14.8-r6"],"technology_ids":["core-osv","wazuh-dashboard-alerting-dashboards-plugin"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T10:13:09+00:00"},{"id":"dfe3874a3984ef3e97abf154fb9c08fa2097c25741a1a5baf1ec2b7cff3f575a","cvss":{"score":2.3,"source":"CGA-275m-5rm9-xw6v","version":"4.0"},"kind":"advisory","title":"CGA-275m-5rm9-xw6v","active":true,"cursor":79123,"cve_ids":[],"records":[{"id":"3f346c68b622a0ca232292b5ccba8dffe4d5768eb47c6c2cf97204ec7b854fbb","url":"https://osv.dev/vulnerability/CGA-275m-5rm9-xw6v","method":"structured","payload":{"kind":"advisory","title":"CGA-275m-5rm9-xw6v","summary":"CGA-275m-5rm9-xw6v","evidence":"osv:CGA-275m-5rm9-xw6v","products":[{"name":{"value":"wazuh-dashboard-dashboards-notifications-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.8-r6","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"CGA-275m-5rm9-xw6v","aliases":["CGA-275m-5rm9-xw6v"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.8-r6"}]}],"package":{"name":"wazuh-dashboard-dashboards-notifications-fips","purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-notifications-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-275m-5rm9-xw6v.json"},"ecosystem_specific":{"components":[{"component_name":"dompurify","component_purl":"pkg:npm/dompurify@3.4.13","component_type":"npm","component_version":"3.4.13","component_location":"/usr/share/wazuh-dashboard/plugins/notificationsDashboards/yarn.lock","latest_event_status":"fixed","latest_event_timestamp":"2026-10-06T13:18:13Z"}]}}],"modified":"2026-10-06T17:45:04.246706244Z","provider":"osv","upstream":["GHSA-p98j-92pf-mc4p"],"references":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-p98j-92pf-mc4p","https://github.com/cure53/DOMPurify/pull/1636","https://github.com/cure53/DOMPurify/commit/b9b9d80f7e401771c2ccaef5f45def7eec8f27d7","https://github.com/cure53/DOMPurify","https://github.com/cure53/DOMPurify/releases/tag/3.4.16"]},"related_cves":[],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89688,"published_at":"2026-10-01T12:46:56+00:00"}],"summary":"CGA-275m-5rm9-xw6v","revision":1,"severity":"low","important":false,"created_at":"2026-10-27T13:55:31.76+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:55:31.76+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-275m-5rm9-xw6v"],"fix_available":true,"fixed_cve_ids":[],"product_names":["wazuh-dashboard-dashboards-notifications-fips"],"fixed_versions":["4.14.8-r6"],"technology_ids":["core-osv","wazuh-dashboard-dashboards-notifications-fips"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T12:46:56+00:00"},{"id":"ccbc5f1f1fe250336a3cff26ff0beaa48df20fb107007d9513e204d519fd163d","cvss":{"score":7.5,"source":"CGA-q9p4-c4m9-58xw","version":"3.1"},"kind":"advisory","title":"CGA-q9p4-c4m9-58xw","active":true,"cursor":79122,"cve_ids":["CVE-2026-91777"],"records":[{"id":"793a5f733ab78a846fce97b5d56cb5c15063ae5a9bb1caa9f05c93b868d94270","url":"https://osv.dev/vulnerability/CGA-q9p4-c4m9-58xw","method":"structured","payload":{"kind":"advisory","title":"CGA-q9p4-c4m9-58xw","summary":"CGA-q9p4-c4m9-58xw","evidence":"osv:CGA-q9p4-c4m9-58xw","products":[{"name":{"value":"sonarqube","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"sonarqube","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-q9p4-c4m9-58xw","aliases":["CGA-q9p4-c4m9-58xw"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"sonarqube","purl":"pkg:apk/chainguard/sonarqube?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q9p4-c4m9-58xw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.2","component_type":"java-archive","component_version":"3.2.2","component_location":"/usr/share/sonarqube/lib/scanner/sonar-scanner-engine-community-13.12.0.5977.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-02T21:03:10Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"sonarqube","purl":"pkg:apk/wolfi/sonarqube?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q9p4-c4m9-58xw.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@3.2.2","component_type":"java-archive","component_version":"3.2.2","component_location":"/usr/share/sonarqube/lib/scanner/sonar-scanner-engine-community-13.12.0.5977.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-02T21:03:10Z"}]}}],"modified":"2026-10-06T17:25:04.449953889Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89670,"published_at":"2026-10-01T12:09:15+00:00"}],"summary":"CGA-q9p4-c4m9-58xw","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:55:19.338+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:55:19.338+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-q9p4-c4m9-58xw"],"fix_available":false,"fixed_cve_ids":[],"product_names":["sonarqube"],"fixed_versions":[],"technology_ids":["core-osv","sonarqube"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T12:09:15+00:00"},{"id":"90efd61b518deb690b7c7e801f88fc784baabb4c07ba899110aebca8de7ab5e2","cvss":{"score":7.5,"source":"CGA-574x-wcqg-qqhf","version":"3.1"},"kind":"advisory","title":"CGA-574x-wcqg-qqhf","active":true,"cursor":79121,"cve_ids":["CVE-2026-91776"],"records":[{"id":"825d9196ab579aeacc418ed4d51ac2efddebf9dd5a2e6d4e8b4860de00f62fe8","url":"https://osv.dev/vulnerability/CGA-574x-wcqg-qqhf","method":"structured","payload":{"kind":"advisory","title":"CGA-574x-wcqg-qqhf","summary":"CGA-574x-wcqg-qqhf","evidence":"osv:CGA-574x-wcqg-qqhf","products":[{"name":{"value":"cassandra-4.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.21-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-574x-wcqg-qqhf","aliases":["CGA-574x-wcqg-qqhf"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.21-r3"}]}],"package":{"name":"cassandra-4.0","purl":"pkg:apk/chainguard/cassandra-4.0?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-574x-wcqg-qqhf.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/cassandra/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T08:17:06Z"}]}}],"modified":"2026-10-06T17:27:56.686098030Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89681,"published_at":"2026-10-01T04:23:31+00:00"}],"summary":"CGA-574x-wcqg-qqhf","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:54:28.44+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:54:28.44+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-574x-wcqg-qqhf"],"fix_available":true,"fixed_cve_ids":[],"product_names":["cassandra-4.0"],"fixed_versions":["4.0.21-r3"],"technology_ids":["cassandra-4-0","core-osv"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T04:23:31+00:00"},{"id":"cfd1c0b880b86aeec241c7e50f38c453c91c25168456be7ece2a6f1acb40e08f","cvss":{"score":7.5,"source":"CGA-2757-w28w-p7r9","version":"3.1"},"kind":"advisory","title":"CGA-2757-w28w-p7r9","active":true,"cursor":79120,"cve_ids":["CVE-2026-91777"],"records":[{"id":"9af6fde8b4255f64a8a1e2c3aaaf63219cf6218313b1e71ad03fe8c42c6322bb","url":"https://osv.dev/vulnerability/CGA-2757-w28w-p7r9","method":"structured","payload":{"kind":"advisory","title":"CGA-2757-w28w-p7r9","summary":"CGA-2757-w28w-p7r9","evidence":"osv:CGA-2757-w28w-p7r9","products":[{"name":{"value":"solr-fips-9-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2757-w28w-p7r9","aliases":["CGA-2757-w28w-p7r9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"solr-fips-9-full","purl":"pkg:apk/chainguard/solr-fips-9-full?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2757-w28w-p7r9.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.12.7.1","component_type":"java-archive","component_version":"2.12.7.1","component_location":"/usr/share/java/solr/modules/hdfs/lib/hadoop-client-runtime-3.4.3.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-05T22:21:12Z"}]}}],"modified":"2026-10-06T17:45:04.228916376Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89687,"published_at":"2026-10-01T12:22:17+00:00"}],"summary":"CGA-2757-w28w-p7r9","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:54:27.794+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:54:27.794+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-2757-w28w-p7r9"],"fix_available":false,"fixed_cve_ids":[],"product_names":["solr-fips-9-full"],"fixed_versions":[],"technology_ids":["core-osv","solr-fips-9-full"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T12:22:17+00:00"},{"id":"fbfa023c65feebc634864c4440242d46d824947f41e2528eaacd8e0fc98ccdd5","cvss":{"score":6.3,"source":"CGA-mwvp-8ghr-gf9r","version":"4.0"},"kind":"advisory","title":"CGA-mwvp-8ghr-gf9r","active":true,"cursor":79119,"cve_ids":["CVE-2026-81872"],"records":[{"id":"270d68d4b57014e5fe5dbbbd93712167d16511c82d7e5b47696dfe03e1b274cd","url":"https://osv.dev/vulnerability/CGA-mwvp-8ghr-gf9r","method":"structured","payload":{"kind":"advisory","title":"CGA-mwvp-8ghr-gf9r","summary":"CGA-mwvp-8ghr-gf9r","evidence":"osv:CGA-mwvp-8ghr-gf9r","products":[{"name":{"value":"redpanda-operator-25.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mwvp-8ghr-gf9r","aliases":["CGA-mwvp-8ghr-gf9r"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"redpanda-operator-25.2","purl":"pkg:apk/chainguard/redpanda-operator-25.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mwvp-8ghr-gf9r.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/manager","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-06T02:24:03Z"}]}}],"modified":"2026-10-06T17:27:54.569529529Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89679,"published_at":"2026-09-30T12:36:32+00:00"}],"summary":"CGA-mwvp-8ghr-gf9r","revision":1,"severity":"medium","important":false,"created_at":"2026-10-27T13:54:03.218+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:54:03.218+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-mwvp-8ghr-gf9r"],"fix_available":false,"fixed_cve_ids":[],"product_names":["redpanda-operator-25.2"],"fixed_versions":[],"technology_ids":["core-osv","redpanda-operator-25-2"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-09-30T12:36:32+00:00"},{"id":"b482eb82f2e4113c897ffc08a2613528b9ab4c2be0080106b8423efbd31198f2","cvss":{"score":8.8,"source":"CGA-26v3-3xw3-4pcv","version":"3.1"},"kind":"advisory","title":"CGA-26v3-3xw3-4pcv","active":true,"cursor":79118,"cve_ids":["CVE-2026-34040"],"records":[{"id":"5f3cd525f1b8257caaf9cb65631452e5a853083f14548c470f20bb6666e16b18","url":"https://osv.dev/vulnerability/CGA-26v3-3xw3-4pcv","method":"structured","payload":{"kind":"advisory","title":"CGA-26v3-3xw3-4pcv","summary":"CGA-26v3-3xw3-4pcv","evidence":"osv:CGA-26v3-3xw3-4pcv","products":[{"name":{"value":"datadog-agent-7.84","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-26v3-3xw3-4pcv","aliases":["CGA-26v3-3xw3-4pcv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.84","purl":"pkg:apk/chainguard/datadog-agent-7.84?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-26v3-3xw3-4pcv.json"},"ecosystem_specific":{"components":[{"component_name":"github.com/docker/docker","component_purl":"pkg:golang/github.com/docker/docker@v28.5.3-0.20260325154711-31a1689cb0a1%2Bincompatible","component_type":"go-module","component_version":"v28.5.3-0.20260325154711-31a1689cb0a1+incompatible","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-06T11:56:23Z"}]}}],"modified":"2026-10-06T17:45:04.207159816Z","provider":"osv","upstream":["CVE-2026-34040","GHSA-x744-4wpc-v9h2","GO-2026-4887"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34040.json","https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","https://nvd.nist.gov/vuln/detail/CVE-2026-34040"]},"related_cves":[{"value":"CVE-2026-34040","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89685,"published_at":"2026-10-03T00:08:59+00:00"}],"summary":"CGA-26v3-3xw3-4pcv","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:53:52.171+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:53:52.171+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-26v3-3xw3-4pcv"],"fix_available":false,"fixed_cve_ids":[],"product_names":["datadog-agent-7.84"],"fixed_versions":[],"technology_ids":["core-osv","datadog-agent-7-84"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-03T00:08:59+00:00"},{"id":"efb1466c43e6d521ce85b2b3c16edd3c08156d9fd9e9659c7608c21ce5965cf2","cvss":{"score":4.4,"source":"CGA-wqv9-pj7x-q7r3","version":"3.1"},"kind":"advisory","title":"CGA-wqv9-pj7x-q7r3","active":true,"cursor":79117,"cve_ids":["CVE-2026-102270"],"records":[{"id":"7eb3af8a2d07bd91ab1a9614a28a65c554da723b45263ab52fffe66aacb51cbd","url":"https://osv.dev/vulnerability/CGA-wqv9-pj7x-q7r3","method":"structured","payload":{"kind":"advisory","title":"CGA-wqv9-pj7x-q7r3","summary":"CGA-wqv9-pj7x-q7r3","evidence":"osv:CGA-wqv9-pj7x-q7r3","products":[{"name":{"value":"nemo-rl-cuda-13.0-vllm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.7.0-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wqv9-pj7x-q7r3","aliases":["CGA-wqv9-pj7x-q7r3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-r2"}]}],"package":{"name":"nemo-rl-cuda-13.0-vllm","purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-vllm?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wqv9-pj7x-q7r3.json"},"ecosystem_specific":{"components":[{"component_name":"pyjwt","component_purl":"pkg:pypi/pyjwt@2.13.0","component_type":"python","component_version":"2.13.0","component_location":"/opt/chainguard/nemo-rl/venvs/vllm/lib/python3.13/site-packages/pyjwt-2.13.0.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-06T01:52:35Z"}]}}],"modified":"2026-10-06T17:25:06.000369411Z","provider":"osv","upstream":["CVE-2026-102270","GHSA-jwrc-g2q2-pq5p"],"references":["https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102270.json","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p","https://nvd.nist.gov/vuln/detail/CVE-2026-102270","https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07"]},"related_cves":[{"value":"CVE-2026-102270","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89677,"published_at":"2026-10-01T13:00:29+00:00"}],"summary":"CGA-wqv9-pj7x-q7r3","revision":1,"severity":"medium","important":false,"created_at":"2026-10-27T13:53:51.955+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:53:51.955+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-wqv9-pj7x-q7r3"],"fix_available":true,"fixed_cve_ids":[],"product_names":["nemo-rl-cuda-13.0-vllm"],"fixed_versions":["0.7.0-r2"],"technology_ids":["core-osv","nemo-rl-cuda-13-0-vllm"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T13:00:29+00:00"},{"id":"82eef69c269b05fb0c49f3b2ff8fc9b106ccec82e8343d681bdff9ad30a1a2c5","cvss":{"score":7.5,"source":"CGA-jjvc-q6x2-9x28","version":"3.1"},"kind":"advisory","title":"CGA-jjvc-q6x2-9x28","active":true,"cursor":79116,"cve_ids":["CVE-2026-91776"],"records":[{"id":"5189bb391e72c9a9c03bbf7a35242a5114b84e86071b9b525b60656e18d7e54b","url":"https://osv.dev/vulnerability/CGA-jjvc-q6x2-9x28","method":"structured","payload":{"kind":"advisory","title":"CGA-jjvc-q6x2-9x28","summary":"CGA-jjvc-q6x2-9x28","evidence":"osv:CGA-jjvc-q6x2-9x28","products":[{"name":{"value":"cassandra-4.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.21-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-jjvc-q6x2-9x28","aliases":["CGA-jjvc-q6x2-9x28"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.21-r3"}]}],"package":{"name":"cassandra-4.0","purl":"pkg:apk/chainguard/cassandra-4.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jjvc-q6x2-9x28.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/cassandra/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T07:53:06Z"}]}}],"modified":"2026-10-06T17:27:56.873580173Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89684,"published_at":"2026-10-01T04:20:08+00:00"}],"summary":"CGA-jjvc-q6x2-9x28","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:53:24.937+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:53:24.937+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-jjvc-q6x2-9x28"],"fix_available":true,"fixed_cve_ids":[],"product_names":["cassandra-4.0"],"fixed_versions":["4.0.21-r3"],"technology_ids":["cassandra-4-0","core-osv"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T04:20:08+00:00"},{"id":"fd2590e3d42f08f9821596865273e8fd1f6e3129797b2aa523438ffa93ae7a5d","cvss":null,"kind":"advisory","title":"CGA-27m8-65r4-9x7p","active":true,"cursor":79115,"cve_ids":["CVE-2026-75140"],"records":[{"id":"6c81dcfe0c493e34015a5f0a6f77f14ed080f5400b17d840ee5cc89ea417995f","url":"https://osv.dev/vulnerability/CGA-27m8-65r4-9x7p","method":"structured","payload":{"kind":"advisory","title":"CGA-27m8-65r4-9x7p","summary":"CGA-27m8-65r4-9x7p","evidence":"osv:CGA-27m8-65r4-9x7p","products":[{"name":{"value":"eco-java-gradle-8.14.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-27m8-65r4-9x7p","aliases":["CGA-27m8-65r4-9x7p"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"eco-java-gradle-8.14.3","purl":"pkg:apk/chainguard/eco-java-gradle-8.14.3?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-27m8-65r4-9x7p.json"},"ecosystem_specific":{"components":[{"component_name":"jsoup","component_purl":"pkg:maven/jsoup@1.15.3","component_type":"java-archive","component_version":"1.15.3","component_location":"/usr/lib/gradle/8.14.3/lib/jsoup-1.15.3.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-06T14:13:17Z"}]}}],"modified":"2026-10-06T17:45:04.164420457Z","provider":"osv","upstream":["CVE-2026-75140","GHSA-65r4-943x-97jj"],"references":[]},"related_cves":[{"value":"CVE-2026-75140","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"source_id":"core-osv","document_id":89683,"published_at":"2026-10-06T14:13:16+00:00"}],"summary":"CGA-27m8-65r4-9x7p","revision":1,"severity":"unknown","important":false,"created_at":"2026-10-27T13:53:22.123+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:53:22.123+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-27m8-65r4-9x7p"],"fix_available":false,"fixed_cve_ids":[],"product_names":["eco-java-gradle-8.14.3"],"fixed_versions":[],"technology_ids":["core-osv","eco-java-gradle-8-14-3"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-06T14:13:16+00:00"},{"id":"bb68702aed2c70bc64b8727e07a153eb533fcd04056ca4dafaaf3dd5e49aa2f8","cvss":{"score":7.5,"source":"CGA-2h8r-cfcw-pv6x","version":"3.1"},"kind":"advisory","title":"CGA-2h8r-cfcw-pv6x","active":true,"cursor":79114,"cve_ids":["CVE-2026-91777"],"records":[{"id":"fb6aaa0a235590cde869ab2add80aa3a2c9c644ead57cb2301c4b007c69da263","url":"https://osv.dev/vulnerability/CGA-2h8r-cfcw-pv6x","method":"structured","payload":{"kind":"advisory","title":"CGA-2h8r-cfcw-pv6x","summary":"CGA-2h8r-cfcw-pv6x","evidence":"osv:CGA-2h8r-cfcw-pv6x","products":[{"name":{"value":"cassandra-4.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.21-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-2h8r-cfcw-pv6x","aliases":["CGA-2h8r-cfcw-pv6x"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.21-r3"}]}],"package":{"name":"cassandra-4.0","purl":"pkg:apk/chainguard/cassandra-4.0?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-2h8r-cfcw-pv6x.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/cassandra/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T08:17:07Z"}]}}],"modified":"2026-10-06T17:27:56.172710255Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89682,"published_at":"2026-10-01T04:23:31+00:00"}],"summary":"CGA-2h8r-cfcw-pv6x","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:52:55.085+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:52:55.085+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-2h8r-cfcw-pv6x"],"fix_available":true,"fixed_cve_ids":[],"product_names":["cassandra-4.0"],"fixed_versions":["4.0.21-r3"],"technology_ids":["cassandra-4-0","core-osv"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T04:23:31+00:00"},{"id":"b4d2d19f1a806b482f81d7de97130c2bf7470b1eb82e86f6b4d12abb48d62c7a","cvss":{"score":6.5,"source":"CGA-rpp2-32xx-x8w3","version":"3.1"},"kind":"advisory","title":"CGA-rpp2-32xx-x8w3","active":true,"cursor":79113,"cve_ids":["CVE-2026-103001"],"records":[{"id":"9bfdd5a4e754107971063de7eb222af52cd47b0587a103cad6e6a7e7ba3b6583","url":"https://osv.dev/vulnerability/CGA-rpp2-32xx-x8w3","method":"structured","payload":{"kind":"advisory","title":"CGA-rpp2-32xx-x8w3","summary":"CGA-rpp2-32xx-x8w3","evidence":"osv:CGA-rpp2-32xx-x8w3","products":[{"name":{"value":"nemo-rl-cuda-13.0-vllm","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.7.0-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rpp2-32xx-x8w3","aliases":["CGA-rpp2-32xx-x8w3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-r2"}]}],"package":{"name":"nemo-rl-cuda-13.0-vllm","purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-vllm?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rpp2-32xx-x8w3.json"},"ecosystem_specific":{"components":[{"component_name":"pyjwt","component_purl":"pkg:pypi/pyjwt@2.13.0","component_type":"python","component_version":"2.13.0","component_location":"/opt/chainguard/nemo-rl/venvs/vllm/lib/python3.13/site-packages/pyjwt-2.13.0.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-06T01:52:34Z"}]}}],"modified":"2026-10-06T17:25:05.192783566Z","provider":"osv","upstream":["CVE-2026-103001","GHSA-gvp8-978c-rx2q"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103001.json","https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35","https://github.com/jpadilla/pyjwt/issues/679","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q","https://nvd.nist.gov/vuln/detail/CVE-2026-103001"]},"related_cves":[{"value":"CVE-2026-103001","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89674,"published_at":"2026-10-01T13:00:29+00:00"}],"summary":"CGA-rpp2-32xx-x8w3","revision":1,"severity":"medium","important":false,"created_at":"2026-10-27T13:52:15.023+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:52:15.023+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-rpp2-32xx-x8w3"],"fix_available":true,"fixed_cve_ids":[],"product_names":["nemo-rl-cuda-13.0-vllm"],"fixed_versions":["0.7.0-r2"],"technology_ids":["core-osv","nemo-rl-cuda-13-0-vllm"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T13:00:29+00:00"},{"id":"86e0d47f45ea484035d9cd10ea692057825234403d74aa48d073ce998c1e26aa","cvss":{"score":7.5,"source":"CGA-vq4g-fqv4-g2g6","version":"3.1"},"kind":"advisory","title":"CGA-vq4g-fqv4-g2g6","active":true,"cursor":79112,"cve_ids":["CVE-2026-102276"],"records":[{"id":"e5f6bb4ac345eef03bc203831830a7a9123c98b1351b2a6bda79df385fa39bb7","url":"https://osv.dev/vulnerability/CGA-vq4g-fqv4-g2g6","method":"structured","payload":{"kind":"advisory","title":"CGA-vq4g-fqv4-g2g6","summary":"CGA-vq4g-fqv4-g2g6","evidence":"osv:CGA-vq4g-fqv4-g2g6","products":[{"name":{"value":"kibana-8.19-bitnami","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.19.22-r5","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-vq4g-fqv4-g2g6","aliases":["CGA-vq4g-fqv4-g2g6"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.19.22-r5"}]}],"package":{"name":"kibana-8.19-bitnami","purl":"pkg:apk/chainguard/kibana-8.19-bitnami?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vq4g-fqv4-g2g6.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@2.1.4","component_type":"npm","component_version":"2.1.4","component_location":"/opt/bitnami/kibana/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:29:11Z"}]}}],"modified":"2026-10-06T17:25:05.812393330Z","provider":"osv","upstream":["CVE-2026-102276","GHSA-6j4f-fj2g-mc7p"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"]},"related_cves":[{"value":"CVE-2026-102276","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89680,"published_at":"2026-09-30T12:52:32+00:00"}],"summary":"CGA-vq4g-fqv4-g2g6","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:51:47.3+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:51:47.3+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-vq4g-fqv4-g2g6"],"fix_available":true,"fixed_cve_ids":[],"product_names":["kibana-8.19-bitnami"],"fixed_versions":["8.19.22-r5"],"technology_ids":["core-osv","kibana-8-19-bitnami"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-09-30T12:52:32+00:00"},{"id":"729fd2f8e8f865f980986a02dd0a60ad6d667e5c350fe0b55038955a31afddd3","cvss":{"score":7.5,"source":"CGA-cxh4-mrr2-hp7q","version":"3.1"},"kind":"advisory","title":"CGA-cxh4-mrr2-hp7q","active":true,"cursor":79111,"cve_ids":["CVE-2026-91777"],"records":[{"id":"82cebb5d1307e05fa477fbdfcd40dfdc6d49bbc08e9a5f35f729dcfcf1df1bfd","url":"https://osv.dev/vulnerability/CGA-cxh4-mrr2-hp7q","method":"structured","payload":{"kind":"advisory","title":"CGA-cxh4-mrr2-hp7q","summary":"CGA-cxh4-mrr2-hp7q","evidence":"osv:CGA-cxh4-mrr2-hp7q","products":[{"name":{"value":"cassandra-4.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.21-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-cxh4-mrr2-hp7q","aliases":["CGA-cxh4-mrr2-hp7q"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.21-r3"}]}],"package":{"name":"cassandra-4.0","purl":"pkg:apk/chainguard/cassandra-4.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cxh4-mrr2-hp7q.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/cassandra/lib/jackson-databind-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T07:53:08Z"}]}}],"modified":"2026-10-06T17:27:52.979936713Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89678,"published_at":"2026-10-01T04:20:08+00:00"}],"summary":"CGA-cxh4-mrr2-hp7q","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:51:20.565+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:51:20.565+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-cxh4-mrr2-hp7q"],"fix_available":true,"fixed_cve_ids":[],"product_names":["cassandra-4.0"],"fixed_versions":["4.0.21-r3"],"technology_ids":["cassandra-4-0","core-osv"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T04:20:08+00:00"},{"id":"eb935ad801a9af8d869bf3830ca738f34d2e20bcbad47ce133ab7942793c665d","cvss":{"score":7.5,"source":"CGA-v4mc-qf4x-w444","version":"3.1"},"kind":"advisory","title":"CGA-v4mc-qf4x-w444","active":true,"cursor":79110,"cve_ids":["CVE-2026-19534"],"records":[{"id":"4ea2fe45d774771ea98211f2064833c98321aa7bcaeb56063a5bfd0809b6e46c","url":"https://osv.dev/vulnerability/CGA-v4mc-qf4x-w444","method":"structured","payload":{"kind":"advisory","title":"CGA-v4mc-qf4x-w444","summary":"CGA-v4mc-qf4x-w444","evidence":"osv:CGA-v4mc-qf4x-w444","products":[{"name":{"value":"prism","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r14","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"prism","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r14","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-v4mc-qf4x-w444","aliases":["CGA-v4mc-qf4x-w444"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r14"}]}],"package":{"name":"prism","purl":"pkg:apk/chainguard/prism?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v4mc-qf4x-w444.json"},"ecosystem_specific":{"components":[{"component_name":"undici","component_purl":"pkg:npm/undici@8.9.0","component_type":"npm","component_version":"8.9.0","component_location":"/usr/src/prism/node_modules/undici/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:10:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r14"}]}],"package":{"name":"prism","purl":"pkg:apk/wolfi/prism?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v4mc-qf4x-w444.json"},"ecosystem_specific":{"components":[{"component_name":"undici","component_purl":"pkg:npm/undici@8.9.0","component_type":"npm","component_version":"8.9.0","component_location":"/usr/src/prism/node_modules/undici/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:10:08Z"}]}}],"modified":"2026-10-06T17:25:05.227210404Z","provider":"osv","upstream":["CVE-2026-19534","GHSA-rfgv-xxqx-mfg5"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19534.json","https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5","https://nvd.nist.gov/vuln/detail/CVE-2026-19534"]},"related_cves":[{"value":"CVE-2026-19534","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89673,"published_at":"2026-09-30T10:21:14+00:00"}],"summary":"CGA-v4mc-qf4x-w444","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:51:18.468+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:51:18.468+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-v4mc-qf4x-w444"],"fix_available":true,"fixed_cve_ids":[],"product_names":["prism"],"fixed_versions":["5.16.0-r14"],"technology_ids":["core-osv","prism"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-09-30T10:21:14+00:00"},{"id":"b9e67a2b2bb2fc306116fdf333122709e7bd4ba3c4fcdd9b1b3e4594a3f3b11d","cvss":{"score":7.5,"source":"CGA-pxrq-4x29-4g25","version":"3.1"},"kind":"advisory","title":"CGA-pxrq-4x29-4g25","active":true,"cursor":79109,"cve_ids":["CVE-2026-91777"],"records":[{"id":"34d4842f5723afbc9db0fafc111798c7d0bcb1a130bff5caf900f963ad665679","url":"https://osv.dev/vulnerability/CGA-pxrq-4x29-4g25","method":"structured","payload":{"kind":"advisory","title":"CGA-pxrq-4x29-4g25","summary":"CGA-pxrq-4x29-4g25","evidence":"osv:CGA-pxrq-4x29-4g25","products":[{"name":{"value":"kayenta-2026.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-pxrq-4x29-4g25","aliases":["CGA-pxrq-4x29-4g25"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"kayenta-2026.2","purl":"pkg:apk/chainguard/kayenta-2026.2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pxrq-4x29-4g25.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.2","component_type":"java-archive","component_version":"2.18.2","component_location":"/opt/kayenta/lib/signalfx-java-1.0.49.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-02T23:59:53Z"}]}}],"modified":"2026-10-06T17:25:04.006054926Z","provider":"osv","upstream":["CVE-2026-91777","GHSA-cxp5-3px4-pw24"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","https://nvd.nist.gov/vuln/detail/CVE-2026-91777","https://github.com/FasterXML/jackson-databind/issues/6204","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91777","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89669,"published_at":"2026-10-01T13:49:34+00:00"}],"summary":"CGA-pxrq-4x29-4g25","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:50:50.03+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:50:50.03+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-pxrq-4x29-4g25"],"fix_available":false,"fixed_cve_ids":[],"product_names":["kayenta-2026.2"],"fixed_versions":[],"technology_ids":["core-osv","kayenta-2026-2"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T13:49:34+00:00"},{"id":"6f1350f14af3722c1234e822d1bc770001081c9b981161513f23703bf4ea5d7c","cvss":{"score":3.7,"source":"CGA-vfmv-ppj2-h2h3","version":"3.1"},"kind":"advisory","title":"CGA-vfmv-ppj2-h2h3","active":true,"cursor":79108,"cve_ids":["CVE-2026-85008"],"records":[{"id":"74563f40cccc9b5e58e394960814c515464fbf6579ed3851a836cd56ceed438f","url":"https://osv.dev/vulnerability/CGA-vfmv-ppj2-h2h3","method":"structured","payload":{"kind":"advisory","title":"CGA-vfmv-ppj2-h2h3","summary":"CGA-vfmv-ppj2-h2h3","evidence":"osv:CGA-vfmv-ppj2-h2h3","products":[{"name":{"value":"prism","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r14","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"prism","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.16.0-r14","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"CGA-vfmv-ppj2-h2h3","aliases":["CGA-vfmv-ppj2-h2h3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r14"}]}],"package":{"name":"prism","purl":"pkg:apk/chainguard/prism?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vfmv-ppj2-h2h3.json"},"ecosystem_specific":{"components":[{"component_name":"undici","component_purl":"pkg:npm/undici@8.9.0","component_type":"npm","component_version":"8.9.0","component_location":"/usr/src/prism/node_modules/undici/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:10:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.0-r14"}]}],"package":{"name":"prism","purl":"pkg:apk/wolfi/prism?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vfmv-ppj2-h2h3.json"},"ecosystem_specific":{"components":[{"component_name":"undici","component_purl":"pkg:npm/undici@8.9.0","component_type":"npm","component_version":"8.9.0","component_location":"/usr/src/prism/node_modules/undici/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:10:08Z"}]}}],"modified":"2026-10-06T17:25:05.683044613Z","provider":"osv","upstream":["CVE-2026-85008","GHSA-8436-99hf-9mmv"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85008.json","https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv","https://nvd.nist.gov/vuln/detail/CVE-2026-85008"]},"related_cves":[{"value":"CVE-2026-85008","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89676,"published_at":"2026-09-30T10:21:13+00:00"}],"summary":"CGA-vfmv-ppj2-h2h3","revision":1,"severity":"low","important":false,"created_at":"2026-10-27T13:50:16.603+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:50:16.603+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-vfmv-ppj2-h2h3"],"fix_available":true,"fixed_cve_ids":[],"product_names":["prism"],"fixed_versions":["5.16.0-r14"],"technology_ids":["core-osv","prism"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-09-30T10:21:13+00:00"},{"id":"46a8bdf57dec8155127452acb0d7f691baf446f666a76790a7cad7d9f740fefb","cvss":{"score":7.6,"source":"CGA-rfj3-mfq7-w934","version":"4.0"},"kind":"advisory","title":"CGA-rfj3-mfq7-w934","active":true,"cursor":79107,"cve_ids":["CVE-2026-97687"],"records":[{"id":"c7ffada14e70b92da62a811c3236dbede302e320d16e505626d6581da97e671b","url":"https://osv.dev/vulnerability/CGA-rfj3-mfq7-w934","method":"structured","payload":{"kind":"advisory","title":"CGA-rfj3-mfq7-w934","summary":"CGA-rfj3-mfq7-w934","evidence":"osv:CGA-rfj3-mfq7-w934","products":[{"name":{"value":"commercial-gitlab-toolbox-ee-fips-19.1","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"19.1.8-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rfj3-mfq7-w934","aliases":["CGA-rfj3-mfq7-w934"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.1.8-r1"}]}],"package":{"name":"commercial-gitlab-toolbox-ee-fips-19.1","purl":"pkg:apk/chainguard/commercial-gitlab-toolbox-ee-fips-19.1?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rfj3-mfq7-w934.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/python3.12/site-packages/urllib3-2.7.0.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:00:12Z"}]}}],"modified":"2026-10-06T17:25:05.228203069Z","provider":"osv","upstream":["CVE-2026-97687","GHSA-8988-9cw3-xx77"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97687.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093"]},"related_cves":[{"value":"CVE-2026-97687","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89675,"published_at":"2026-10-01T13:39:37+00:00"}],"summary":"CGA-rfj3-mfq7-w934","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:49:45.015+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:49:45.015+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-rfj3-mfq7-w934"],"fix_available":true,"fixed_cve_ids":[],"product_names":["commercial-gitlab-toolbox-ee-fips-19.1"],"fixed_versions":["19.1.8-r1"],"technology_ids":["commercial-gitlab-toolbox-ee-fips-19-1","core-osv"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T13:39:37+00:00"},{"id":"c3a6fdab7a16a582b23a9e71c1130c602ebe8c73b90bdefb3d8512fb06c638d5","cvss":{"score":7.5,"source":"CGA-rxgv-4c7m-jcjp","version":"3.1"},"kind":"advisory","title":"CGA-rxgv-4c7m-jcjp","active":true,"cursor":79106,"cve_ids":["CVE-2026-91776"],"records":[{"id":"14a090cce45760d48473c02f74cebbcc6933049363de2ba72048b7dc846527a5","url":"https://osv.dev/vulnerability/CGA-rxgv-4c7m-jcjp","method":"structured","payload":{"kind":"advisory","title":"CGA-rxgv-4c7m-jcjp","summary":"CGA-rxgv-4c7m-jcjp","evidence":"osv:CGA-rxgv-4c7m-jcjp","products":[{"name":{"value":"elasticsearch-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-rxgv-4c7m-jcjp","aliases":["CGA-rxgv-4c7m-jcjp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"elasticsearch-9.4","purl":"pkg:apk/chainguard/elasticsearch-9.4?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rxgv-4c7m-jcjp.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.21.3","component_type":"java-archive","component_version":"2.21.3","component_location":"/usr/share/elasticsearch/modules/esql-datasource-parquet/parquet-hadoop-bundle-1.18.1.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-02T22:00:54Z"}]}}],"modified":"2026-10-06T17:25:05.226628655Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89672,"published_at":"2026-10-01T12:32:27+00:00"}],"summary":"CGA-rxgv-4c7m-jcjp","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:48:03.304+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:48:03.304+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-rxgv-4c7m-jcjp"],"fix_available":false,"fixed_cve_ids":[],"product_names":["elasticsearch-9.4"],"fixed_versions":[],"technology_ids":["core-osv","elasticsearch-9-4"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T12:32:27+00:00"},{"id":"a64d05ec7981f08b45d60b6ed7b8916d6b554bd220e88a18a9de74d2261e67a3","cvss":{"score":7.5,"source":"CGA-qfrq-3q3j-4vxc","version":"3.1"},"kind":"advisory","title":"CGA-qfrq-3q3j-4vxc","active":true,"cursor":79105,"cve_ids":["CVE-2026-68497"],"records":[{"id":"0c7213798b8dc425684a53b2906fa3bee41fa5b72506303750a434a7090691d5","url":"https://osv.dev/vulnerability/CGA-qfrq-3q3j-4vxc","method":"structured","payload":{"kind":"advisory","title":"CGA-qfrq-3q3j-4vxc","summary":"CGA-qfrq-3q3j-4vxc","evidence":"osv:CGA-qfrq-3q3j-4vxc","products":[{"name":{"value":"kserve-modelmesh","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.12.0-r41","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kserve-modelmesh","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.12.0-r41","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-qfrq-3q3j-4vxc","aliases":["CGA-qfrq-3q3j-4vxc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-r41"}]}],"package":{"name":"kserve-modelmesh","purl":"pkg:apk/chainguard/kserve-modelmesh?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qfrq-3q3j-4vxc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/opt/kserve/mmesh/lib/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:06:54Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-r41"}]}],"package":{"name":"kserve-modelmesh","purl":"pkg:apk/wolfi/kserve-modelmesh?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-qfrq-3q3j-4vxc.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.18.9","component_type":"java-archive","component_version":"2.18.9","component_location":"/opt/kserve/mmesh/lib/jackson-databind-2.18.9.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:06:54Z"}]}}],"modified":"2026-10-06T17:25:04.505573454Z","provider":"osv","upstream":["CVE-2026-68497","GHSA-q4xh-88c3-wmh7"],"references":["https://repo.maven.apache.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68497.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7","https://nvd.nist.gov/vuln/detail/CVE-2026-68497","https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd","https://github.com/FasterXML/jackson-databind/pull/6127","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-68497","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89671,"published_at":"2026-09-29T12:34:17+00:00"}],"summary":"CGA-qfrq-3q3j-4vxc","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:48:00.603+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:48:00.603+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-qfrq-3q3j-4vxc"],"fix_available":true,"fixed_cve_ids":[],"product_names":["kserve-modelmesh"],"fixed_versions":["0.12.0-r41"],"technology_ids":["core-osv","kserve-modelmesh"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-09-29T12:34:17+00:00"},{"id":"042b22f7f7122f10d5ee2b01d54c922d0b2d39f4aad123c9665ba093e0b1a0cf","cvss":{"score":6.3,"source":"CGA-mjjq-w785-g3v5","version":"4.0"},"kind":"advisory","title":"CGA-mjjq-w785-g3v5","active":true,"cursor":79104,"cve_ids":["CVE-2026-81872"],"records":[{"id":"ade07343c44a78ed8437fbde09136ec1a5dde0cdbcf9f1ba44c025555a60c39b","url":"https://osv.dev/vulnerability/CGA-mjjq-w785-g3v5","method":"structured","payload":{"kind":"advisory","title":"CGA-mjjq-w785-g3v5","summary":"CGA-mjjq-w785-g3v5","evidence":"osv:CGA-mjjq-w785-g3v5","products":[{"name":{"value":"guac","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"guac","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mjjq-w785-g3v5","aliases":["CGA-mjjq-w785-g3v5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"guac","purl":"pkg:apk/chainguard/guac?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mjjq-w785-g3v5.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/guaccollect","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-02T21:03:30Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"guac","purl":"pkg:apk/wolfi/guac?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mjjq-w785-g3v5.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/guaccollect","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-02T21:03:30Z"}]}}],"modified":"2026-10-06T17:25:04.008368067Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89668,"published_at":"2026-09-30T13:45:31+00:00"}],"summary":"CGA-mjjq-w785-g3v5","revision":1,"severity":"medium","important":false,"created_at":"2026-10-27T13:47:28.158+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:47:28.158+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-mjjq-w785-g3v5"],"fix_available":false,"fixed_cve_ids":[],"product_names":["guac"],"fixed_versions":[],"technology_ids":["core-osv","guac"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-09-30T13:45:31+00:00"},{"id":"72dc830bc8a0d15624388e81451dfccad03927ab4ee9db0493a3a3b60fd95456","cvss":{"score":5.9,"source":"CGA-mhf8-v8x2-r6jh","version":"3.1"},"kind":"advisory","title":"CGA-mhf8-v8x2-r6jh","active":true,"cursor":79103,"cve_ids":["CVE-2026-17495"],"records":[{"id":"c55a87d8d8dd1fa7659876a0389127f0b0b83f3b2116d267044577db0685b7a6","url":"https://osv.dev/vulnerability/CGA-mhf8-v8x2-r6jh","method":"structured","payload":{"kind":"advisory","title":"CGA-mhf8-v8x2-r6jh","summary":"CGA-mhf8-v8x2-r6jh","evidence":"osv:CGA-mhf8-v8x2-r6jh","products":[{"name":{"value":"kibana-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mhf8-v8x2-r6jh","aliases":["CGA-mhf8-v8x2-r6jh"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"kibana-9.5","purl":"pkg:apk/chainguard/kibana-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mhf8-v8x2-r6jh.json"},"ecosystem_specific":{"components":[{"component_name":"moment","component_purl":"pkg:npm/moment@2.30.1","component_type":"npm","component_version":"2.30.1","component_location":"/usr/share/kibana/node_modules/moment/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:12:19Z"}]}}],"modified":"2026-10-06T17:25:03.998267663Z","provider":"osv","upstream":["CVE-2026-17495","GHSA-4p3w-j4w9-5jqw"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17495.json","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495"]},"related_cves":[{"value":"CVE-2026-17495","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89666,"published_at":"2026-09-30T14:44:58+00:00"}],"summary":"CGA-mhf8-v8x2-r6jh","revision":1,"severity":"medium","important":false,"created_at":"2026-10-27T13:47:28.151+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:47:28.151+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-mhf8-v8x2-r6jh"],"fix_available":true,"fixed_cve_ids":[],"product_names":["kibana-9.5"],"fixed_versions":["9.5.4-r3"],"technology_ids":["core-osv","kibana-9-5"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-09-30T14:44:58+00:00"},{"id":"ea99722dd5c1d52c37e8c28d7c86b9208dcda7be41a68fd7ba007d70e84a7d72","cvss":{"score":7.5,"source":"CGA-xwx3-phjw-v2rr","version":"3.1"},"kind":"advisory","title":"CGA-xwx3-phjw-v2rr","active":true,"cursor":79102,"cve_ids":["CVE-2026-91776"],"records":[{"id":"15d0ef5ef615ce13fb268a5ffcfec6ec0f35289be9e3a1abe0aba0f5fe37043e","url":"https://osv.dev/vulnerability/CGA-xwx3-phjw-v2rr","method":"structured","payload":{"kind":"advisory","title":"CGA-xwx3-phjw-v2rr","summary":"CGA-xwx3-phjw-v2rr","evidence":"osv:CGA-xwx3-phjw-v2rr","products":[{"name":{"value":"pinot","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-xwx3-phjw-v2rr","aliases":["CGA-xwx3-phjw-v2rr"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"pinot","purl":"pkg:apk/chainguard/pinot?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xwx3-phjw-v2rr.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-databind","component_purl":"pkg:maven/jackson-databind@2.22.2","component_type":"java-archive","component_version":"2.22.2","component_location":"/usr/share/java/pinot/lib/pinot-all-1.5.1-jar-with-dependencies.jar","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-02T22:01:03Z"}]}}],"modified":"2026-10-06T17:25:03.527318568Z","provider":"osv","upstream":["CVE-2026-91776","GHSA-wv8q-qhhj-9h54"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91776.json","https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","https://nvd.nist.gov/vuln/detail/CVE-2026-91776","https://github.com/FasterXML/jackson-databind/issues/6203","https://github.com/FasterXML/jackson-databind"]},"related_cves":[{"value":"CVE-2026-91776","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89667,"published_at":"2026-10-01T14:17:25+00:00"}],"summary":"CGA-xwx3-phjw-v2rr","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:47:28.157+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:47:28.157+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-xwx3-phjw-v2rr"],"fix_available":false,"fixed_cve_ids":[],"product_names":["pinot"],"fixed_versions":[],"technology_ids":["core-osv","pinot"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-01T14:17:25+00:00"},{"id":"fa8cd0721d975ad6e841008c1524c36b72c969d150bf31dda2b12c135cc16ac4","cvss":{"score":6.3,"source":"CGA-xvvj-x5cp-9569","version":"4.0"},"kind":"advisory","title":"CGA-xvvj-x5cp-9569","active":true,"cursor":79101,"cve_ids":["CVE-2026-81872"],"records":[{"id":"186d17bfd4ac112e397769fb7bf907b6bedb7e784b6cb52c1d9fa57c236864dd","url":"https://osv.dev/vulnerability/CGA-xvvj-x5cp-9569","method":"structured","payload":{"kind":"advisory","title":"CGA-xvvj-x5cp-9569","summary":"CGA-xvvj-x5cp-9569","evidence":"osv:CGA-xvvj-x5cp-9569","products":[{"name":{"value":"redpanda-operator-26.2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xvvj-x5cp-9569","aliases":["CGA-xvvj-x5cp-9569"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"redpanda-operator-26.2","purl":"pkg:apk/chainguard/redpanda-operator-26.2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xvvj-x5cp-9569.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/usr/bin/manager","latest_event_status":"pending_upstream_fix","latest_event_timestamp":"2026-10-02T21:03:54Z"}]}}],"modified":"2026-10-06T17:25:03.489549591Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89665,"published_at":"2026-09-30T12:34:27+00:00"}],"summary":"CGA-xvvj-x5cp-9569","revision":1,"severity":"medium","important":false,"created_at":"2026-10-27T13:47:00.955+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:47:00.955+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-xvvj-x5cp-9569"],"fix_available":false,"fixed_cve_ids":[],"product_names":["redpanda-operator-26.2"],"fixed_versions":[],"technology_ids":["core-osv","redpanda-operator-26-2"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-09-30T12:34:27+00:00"},{"id":"9112cd7e20dd1e1d4c1bc964a86a1b353be27e80721d99d645de1e825f4d28da","cvss":{"score":7.5,"source":"CGA-wff8-7g8h-8qjq","version":"3.1"},"kind":"advisory","title":"CGA-wff8-7g8h-8qjq","active":true,"cursor":79100,"cve_ids":["CVE-2026-89407"],"records":[{"id":"2897f7403110a38d097e2450e1a20327db6182b0c6577395edabdbcae5e340ca","url":"https://osv.dev/vulnerability/CGA-wff8-7g8h-8qjq","method":"structured","payload":{"kind":"advisory","title":"CGA-wff8-7g8h-8qjq","summary":"CGA-wff8-7g8h-8qjq","evidence":"osv:CGA-wff8-7g8h-8qjq","products":[{"name":{"value":"cassandra-4.0","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.21-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-wff8-7g8h-8qjq","aliases":["CGA-wff8-7g8h-8qjq"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.21-r3"}]}],"package":{"name":"cassandra-4.0","purl":"pkg:apk/chainguard/cassandra-4.0?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wff8-7g8h-8qjq.json"},"ecosystem_specific":{"components":[{"component_name":"jackson-core","component_purl":"pkg:maven/jackson-core@2.21.6","component_type":"java-archive","component_version":"2.21.6","component_location":"/usr/share/java/cassandra/lib/jackson-core-2.21.6.jar","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T07:53:07Z"}]}}],"modified":"2026-10-06T17:25:02.700436529Z","provider":"osv","upstream":["CVE-2026-89407","GHSA-p6pp-m3f8-5c89"],"references":["https://repo1.maven.org/maven2","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89407.json","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core"]},"related_cves":[{"value":"CVE-2026-89407","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89664,"published_at":"2026-10-02T14:22:23+00:00"}],"summary":"CGA-wff8-7g8h-8qjq","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:46:55.203+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:46:55.203+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-wff8-7g8h-8qjq"],"fix_available":true,"fixed_cve_ids":[],"product_names":["cassandra-4.0"],"fixed_versions":["4.0.21-r3"],"technology_ids":["cassandra-4-0","core-osv"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-10-02T14:22:23+00:00"},{"id":"480bc742665c0da0e74706252c8abd9bc910cd044a06c286f35cdfdb6278f30f","cvss":{"score":7.5,"source":"CGA-jm4g-fjjc-3gf5","version":"3.1"},"kind":"advisory","title":"CGA-jm4g-fjjc-3gf5","active":true,"cursor":79099,"cve_ids":["CVE-2026-102278"],"records":[{"id":"32788d97b51265d300cf3fc4a6b357242d7752585aebb45f3ce424072bc2b9c2","url":"https://osv.dev/vulnerability/CGA-jm4g-fjjc-3gf5","method":"structured","payload":{"kind":"advisory","title":"CGA-jm4g-fjjc-3gf5","summary":"CGA-jm4g-fjjc-3gf5","evidence":"osv:CGA-jm4g-fjjc-3gf5","products":[{"name":{"value":"kibana-9.5","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.5.4-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-jm4g-fjjc-3gf5","aliases":["CGA-jm4g-fjjc-3gf5"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.4-r3"}]}],"package":{"name":"kibana-9.5","purl":"pkg:apk/chainguard/kibana-9.5?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jm4g-fjjc-3gf5.json"},"ecosystem_specific":{"components":[{"component_name":"brace-expansion","component_purl":"pkg:npm/brace-expansion@1.1.18","component_type":"npm","component_version":"1.1.18","component_location":"/usr/share/kibana/node_modules/glob/node_modules/brace-expansion/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:12:19Z"}]}}],"modified":"2026-10-06T17:25:01.582051441Z","provider":"osv","upstream":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"references":["https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"]},"related_cves":[{"value":"CVE-2026-102278","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89663,"published_at":"2026-09-30T14:44:57+00:00"}],"summary":"CGA-jm4g-fjjc-3gf5","revision":1,"severity":"high","important":true,"created_at":"2026-10-27T13:46:55.202+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:46:55.202+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-jm4g-fjjc-3gf5"],"fix_available":true,"fixed_cve_ids":[],"product_names":["kibana-9.5"],"fixed_versions":["9.5.4-r3"],"technology_ids":["core-osv","kibana-9-5"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-09-30T14:44:57+00:00"},{"id":"ddb46bbfdc3f96be343d073041e7104923713b4c2d08d760064672e110c0c891","cvss":{"score":5.9,"source":"CGA-jhp4-fvw6-3hvc","version":"3.1"},"kind":"advisory","title":"CGA-jhp4-fvw6-3hvc","active":true,"cursor":79098,"cve_ids":["CVE-2026-17495"],"records":[{"id":"919620f34c9b1a63349bf29de10b19782dac54e3e339a865e114dc5f9780d3a3","url":"https://osv.dev/vulnerability/CGA-jhp4-fvw6-3hvc","method":"structured","payload":{"kind":"advisory","title":"CGA-jhp4-fvw6-3hvc","summary":"CGA-jhp4-fvw6-3hvc","evidence":"osv:CGA-jhp4-fvw6-3hvc","products":[{"name":{"value":"kibana-9.4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.4.7-r4","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-jhp4-fvw6-3hvc","aliases":["CGA-jhp4-fvw6-3hvc"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.7-r4"}]}],"package":{"name":"kibana-9.4","purl":"pkg:apk/chainguard/kibana-9.4?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-jhp4-fvw6-3hvc.json"},"ecosystem_specific":{"components":[{"component_name":"moment","component_purl":"pkg:npm/moment@2.30.1","component_type":"npm","component_version":"2.30.1","component_location":"/usr/share/kibana/node_modules/moment/package.json","latest_event_status":"fixed","latest_event_timestamp":"2026-10-05T16:24:10Z"}]}}],"modified":"2026-10-06T17:25:01.564720024Z","provider":"osv","upstream":["CVE-2026-17495","GHSA-4p3w-j4w9-5jqw"],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17495.json","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495"]},"related_cves":[{"value":"CVE-2026-17495","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"source_id":"core-osv","document_id":89662,"published_at":"2026-09-30T13:54:36+00:00"}],"summary":"CGA-jhp4-fvw6-3hvc","revision":1,"severity":"medium","important":false,"created_at":"2026-10-27T13:46:14.841+00:00","source_ids":["core-osv"],"updated_at":"2026-10-27T13:46:14.841+00:00","replaced_by":[],"source_urls":["https://osv.dev/vulnerability/CGA-jhp4-fvw6-3hvc"],"fix_available":true,"fixed_cve_ids":[],"product_names":["kibana-9.4"],"fixed_versions":["9.4.7-r4"],"technology_ids":["core-osv","kibana-9-4"],"known_exploited":false,"affected_versions":[],"source_published_at":"2026-09-30T13:54:36+00:00"}],"next_after":79127,"next_before":79098}