{"matches":[{"vulnerability":{"id":"GO-2026-4887","dataSource":"https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","namespace":"govulndb:language:go","severity":"High","urls":["https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq"],"description":"Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":7.091550000000001},"relatedVulnerabilities":[{"id":"CVE-2026-34040","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34040","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"],"description":"Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-x744-4wpc-v9h2","dataSource":"https://github.com/advisories/GHSA-x744-4wpc-v9h2","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://nvd.nist.gov/vuln/detail/CVE-2026-34040","https://github.com/moby/moby/releases/tag/docker-v29.3.1"],"description":"Moby has AuthZ plugin bypass when provided oversized request bodies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GO-2026-4887","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3b44c4726d0f371d","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-6g7g-w4f8-9c9x","dataSource":"https://github.com/advisories/GHSA-6g7g-w4f8-9c9x","namespace":"github:language:go","severity":"High","urls":["https://github.com/buger/jsonparser/issues/275","https://github.com/golang/vulndb/issues/4514","https://github.com/buger/jsonparser/pull/276","https://github.com/buger/jsonparser/commit/a69e7e01cd4ad67bdfd3ac2c080b9212af16f4b0","https://github.com/buger/jsonparser/releases/tag/v1.1.2","https://nvd.nist.gov/vuln/detail/CVE-2026-32285","https://pkg.go.dev/vuln/GO-2026-4514","https://securityinfinity.com/research/buger-jsonparser-negative-slice-panic-dos-2026"],"description":"github.com/buger/jsonparser has a denial of service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-32285","epss":0.00779,"percentile":0.55919,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-32285","cwe":"CWE-129","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-32285","cwe":"CWE-1285","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.1.2"],"state":"fixed","available":[{"version":"1.1.2","date":"2026-03-20","kind":"first-observed"}]},"advisories":[],"risk":0.58425},"relatedVulnerabilities":[{"id":"CVE-2026-32285","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32285","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/buger/jsonparser/issues/275","https://github.com/golang/vulndb/issues/4514","https://pkg.go.dev/vuln/GO-2026-4514","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:17121","https://access.redhat.com/errata/RHSA-2026:17123","https://access.redhat.com/errata/RHSA-2026:19099","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:35111","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:7191","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/security/cve/CVE-2026-32285","https://bugzilla.redhat.com/show_bug.cgi?id=2451846","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32285.json","https://securityinfinity.com/research/buger-jsonparser-negative-slice-panic-dos-2026"],"description":"The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-32285","epss":0.00779,"percentile":0.55919,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-32285","cwe":"CWE-129","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-32285","cwe":"CWE-1285","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/buger/jsonparser","version":"v1.1.1"}},"found":{"vulnerabilityID":"GHSA-6g7g-w4f8-9c9x","versionConstraint":"<=1.1.1 (go)"},"fix":{"suggestedVersion":"1.1.2"}}],"artifact":{"id":"pkg:golang/github.com/buger/jsonparser@v1.1.1?package-id=77598a666323aebb","name":"github.com/buger/jsonparser","version":"v1.1.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:buger:jsonparser:v1.1.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/buger/jsonparser@v1.1.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs="}}},{"vulnerability":{"id":"GO-2026-6612","dataSource":"https://go.dev/cl/847187","namespace":"govulndb:language:go","severity":"Critical","urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.56291},"relatedVulnerabilities":[{"id":"CVE-2026-78663","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=24feaffd25f79118","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GO-2026-6603","dataSource":"https://go.dev/cl/847185","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.47025},"relatedVulnerabilities":[{"id":"CVE-2026-78659","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=24feaffd25f79118","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GO-2026-6611","dataSource":"https://go.dev/cl/847186","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.46049999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-78669","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=24feaffd25f79118","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GHSA-92mm-2pjq-r785","dataSource":"https://github.com/advisories/GHSA-92mm-2pjq-r785","namespace":"github:language:go","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-4660","https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311"],"description":"HashiCorp's go-getter library may allow arbitrary file reads","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4660","epss":0.00583,"percentile":0.47892,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4660","cwe":"CWE-200","source":"security@hashicorp.com","type":"Secondary"},{"cve":"CVE-2026-4660","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.8.6"],"state":"fixed","available":[{"version":"1.8.6","date":"2026-04-10","kind":"first-observed"}]},"advisories":[],"risk":0.43724999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-4660","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4660","namespace":"nvd:cpe","severity":"High","urls":["https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311","https://access.redhat.com/errata/RHSA-2026:24478","https://access.redhat.com/security/cve/CVE-2026-4660","https://bugzilla.redhat.com/show_bug.cgi?id=2456909","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4660.json"],"description":"HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security@hashicorp.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4660","epss":0.00583,"percentile":0.47892,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4660","cwe":"CWE-200","source":"security@hashicorp.com","type":"Secondary"},{"cve":"CVE-2026-4660","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/hashicorp/go-getter","version":"v1.8.4"}},"found":{"vulnerabilityID":"GHSA-92mm-2pjq-r785","versionConstraint":"<1.8.6 (go)"},"fix":{"suggestedVersion":"1.8.6"}}],"artifact":{"id":"pkg:golang/github.com/hashicorp/go-getter@v1.8.4?package-id=10d1f6b3003d0968","name":"github.com/hashicorp/go-getter","version":"v1.8.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:hashicorp:go-getter:v1.8.4:*:*:*:*:*:*:*","cpe:2.3:a:hashicorp:go_getter:v1.8.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/hashicorp/go-getter@v1.8.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:hGEd2xsuVKgwkMtPVufq73fAmZU/x65PPcqH3cb0D9A="}}},{"vulnerability":{"id":"GHSA-259r-337f-4rfw","dataSource":"https://github.com/advisories/GHSA-259r-337f-4rfw","namespace":"github:language:go","severity":"High","urls":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://nvd.nist.gov/vuln/detail/CVE-2026-63209","https://github.com/klauspost/compress/pull/1163","https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa","https://github.com/klauspost/compress/releases/tag/v1.18.7"],"description":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.18.7"],"state":"fixed","available":[{"version":"1.18.7","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.42900000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-63209","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/releases/tag/v1.18.7","https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"],"description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/klauspost/compress","version":"v1.18.4"}},"found":{"vulnerabilityID":"GHSA-259r-337f-4rfw","versionConstraint":"<=1.18.6 (go)"},"fix":{"suggestedVersion":"1.18.7"}}],"artifact":{"id":"pkg:golang/github.com/klauspost/compress@v1.18.4?package-id=e3c5eee0f2b5f779","name":"github.com/klauspost/compress","version":"v1.18.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:klauspost:compress:v1.18.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/klauspost/compress@v1.18.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c="}}},{"vulnerability":{"id":"GHSA-542g-h47m-68v8","dataSource":"https://github.com/advisories/GHSA-542g-h47m-68v8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","https://nvd.nist.gov/vuln/detail/CVE-2026-101901","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101901","epss":0.00536,"percentile":0.45211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101901","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.42075999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-101901","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101901","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101901","epss":0.00536,"percentile":0.45211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101901","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-542g-h47m-68v8","versionConstraint":">=1.13.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-7w5x-hrqm-74c2","dataSource":"https://github.com/advisories/GHSA-7w5x-hrqm-74c2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2","https://nvd.nist.gov/vuln/detail/CVE-2026-85730","https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f","https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1","https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0"],"description":"smol-toml: Denial of Service via malformed TOML documents","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85730","epss":0.00524,"percentile":0.44443,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85730","cwe":"CWE-606","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-85730","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.1"],"state":"fixed","available":[{"version":"1.7.1","date":"2026-09-10","kind":"first-observed"}]},"advisories":[],"risk":0.41134},"relatedVulnerabilities":[{"id":"CVE-2026-85730","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85730","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f","https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1","https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2","https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0"],"description":"smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85730","epss":0.00524,"percentile":0.44443,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85730","cwe":"CWE-606","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-85730","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"smol-toml","version":"1.6.1"}},"found":{"vulnerabilityID":"GHSA-7w5x-hrqm-74c2","versionConstraint":"<=1.7.0 (semantic)"},"fix":{"suggestedVersion":"1.7.1"}}],"artifact":{"id":"pkg:npm/smol-toml@1.6.1?package-id=31203824fd2b3719","name":"smol-toml","version":"1.6.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:smol-toml:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol-toml:smol_toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol_toml:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol_toml:smol_toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol:smol_toml:1.6.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/smol-toml@1.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4c29-8rgm-jvjj","dataSource":"https://github.com/advisories/GHSA-4c29-8rgm-jvjj","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj","https://github.com/moby/buildkit/releases/tag/v0.28.1","https://nvd.nist.gov/vuln/detail/CVE-2026-33747"],"description":"BuildKit's Malicious frontend can cause file escape outside of storage root","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33747","epss":0.00507,"percentile":0.43304,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33747","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.28.1"],"state":"fixed","available":[{"version":"0.28.1","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.403065},"relatedVulnerabilities":[{"id":"CVE-2026-33747","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33747","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/moby/buildkit/releases/tag/v0.28.1","https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj"],"description":"BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33747","epss":0.00507,"percentile":0.43304,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33747","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/moby/buildkit","version":"v0.26.3"}},"found":{"vulnerabilityID":"GHSA-4c29-8rgm-jvjj","versionConstraint":"<0.28.1 (go)"},"fix":{"suggestedVersion":"0.28.1"}}],"artifact":{"id":"pkg:golang/github.com/moby/buildkit@v0.26.3?package-id=89520869a43e0cf3","name":"github.com/moby/buildkit","version":"v0.26.3","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:moby:buildkit:v0.26.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/moby/buildkit@v0.26.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:D+ruZVAk/3ipRq5XRxBH9/DIFpRjSlTtMbghT5gQP9g="}}},{"vulnerability":{"id":"GHSA-3pq3-5fj3-cg6v","dataSource":"https://github.com/advisories/GHSA-3pq3-5fj3-cg6v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://nvd.nist.gov/vuln/detail/CVE-2026-101898","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101898","epss":0.00545,"percentile":0.45769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101898","cwe":"CWE-918","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.395125},"relatedVulnerabilities":[{"id":"CVE-2026-101898","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101898","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101898","epss":0.00545,"percentile":0.45769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101898","cwe":"CWE-918","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-3pq3-5fj3-cg6v","versionConstraint":">=1.13.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-x97p-jq2g-jp4f","dataSource":"https://github.com/advisories/GHSA-x97p-jq2g-jp4f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f","https://nvd.nist.gov/vuln/detail/CVE-2026-101909","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype Pollution Gadget in axios toFormData Options","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101909","epss":0.00497,"percentile":0.42653,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101909","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.39263},"relatedVulnerabilities":[{"id":"CVE-2026-101909","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101909","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101909","epss":0.00497,"percentile":0.42653,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101909","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-x97p-jq2g-jp4f","versionConstraint":">=1.15.1,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-vfp3-v2gw-7wfq","dataSource":"https://github.com/advisories/GHSA-vfp3-v2gw-7wfq","namespace":"github:language:go","severity":"High","urls":["https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq","https://nvd.nist.gov/vuln/detail/CVE-2026-55677","https://github.com/labstack/echo/pull/3009","https://github.com/labstack/echo/pull/3011","https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986","https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725","https://github.com/labstack/echo/releases/tag/v4.15.3","https://github.com/labstack/echo/releases/tag/v5.2.0"],"description":"Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-55677","epss":0.00519,"percentile":0.44166,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-55677","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.15.3"],"state":"fixed","available":[{"version":"4.15.3","date":"2026-08-25","kind":"first-observed"}]},"advisories":[],"risk":0.38925},"relatedVulnerabilities":[{"id":"CVE-2026-55677","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55677","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"],"description":"Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-55677","epss":0.00519,"percentile":0.44166,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-55677","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-vfp3-v2gw-7wfq","versionConstraint":"<4.15.3 (go)"},"fix":{"suggestedVersion":"4.15.3"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-cxf3-9h37-7rr8","dataSource":"https://github.com/advisories/GHSA-cxf3-9h37-7rr8","namespace":"github:language:go","severity":"Critical","urls":["https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8","https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec","https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","https://github.com/labstack/echo/releases/tag/v4.16.1","https://github.com/labstack/echo/releases/tag/v5.4.1"],"description":"Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118264","epss":0.0043,"percentile":0.37215,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118264","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118264","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.16.1"],"state":"fixed","available":[{"version":"4.16.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.38915},"relatedVulnerabilities":[{"id":"CVE-2026-118264","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118264","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec","https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","https://github.com/labstack/echo/releases/tag/v4.16.1","https://github.com/labstack/echo/releases/tag/v5.4.1","https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8"],"description":"Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118264","epss":0.0043,"percentile":0.37215,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118264","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118264","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-cxf3-9h37-7rr8","versionConstraint":">=4.0.0,<4.16.1 (go)"},"fix":{"suggestedVersion":"4.16.1"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GO-2026-6355","dataSource":"https://go.dev/issue/81317","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826524","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.\n\nNow, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.375},"relatedVulnerabilities":[{"id":"CVE-2026-56855","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56855","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826524","https://go.dev/issue/81317","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6355"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.55.0"}},"found":{"vulnerabilityID":"GO-2026-6355","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.55.0?package-id=5e2b0ee5639eb777","name":"golang.org/x/crypto","version":"v0.55.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.55.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.55.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.55.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M="}}},{"vulnerability":{"id":"GHSA-8r9p-f939-6h3c","dataSource":"https://github.com/advisories/GHSA-8r9p-f939-6h3c","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c","https://nvd.nist.gov/vuln/detail/CVE-2026-111755","https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects sensitiveHeaders regex escaping can expose credential headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111755","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111755","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111755","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111755","cwe":"CWE-185","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111755","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-8r9p-f939-6h3c","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=9cf253eed2043b51","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q3jh-wrc6-jgq8","dataSource":"https://github.com/advisories/GHSA-q3jh-wrc6-jgq8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8","https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"],"description":"follow-redirects array-form headers bypass cross-origin credential stripping","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.1"],"state":"fixed","available":[{"version":"1.16.1","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.3697349999999999},"relatedVulnerabilities":[{"id":"CVE-2026-111756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111756","epss":0.00471,"percentile":0.40769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111756","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111756","cwe":"CWE-212","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-q3jh-wrc6-jgq8","versionConstraint":">=1.16.0,<1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.1"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=9cf253eed2043b51","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4vrq-3vrq-g6gg","dataSource":"https://github.com/advisories/GHSA-4vrq-3vrq-g6gg","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg","https://docs.docker.com/build/concepts/context/#url-fragments","https://github.com/moby/buildkit/releases/tag/v0.28.1","https://nvd.nist.gov/vuln/detail/CVE-2026-33748"],"description":"BuildKit Git URL subdir component can cause access to restricted files","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33748","epss":0.00481,"percentile":0.41545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33748","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33748","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.28.1"],"state":"fixed","available":[{"version":"0.28.1","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.3691675},"relatedVulnerabilities":[{"id":"CVE-2026-33748","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33748","namespace":"nvd:cpe","severity":"High","urls":["https://docs.docker.com/build/concepts/context/#url-fragments","https://github.com/moby/buildkit/releases/tag/v0.28.1","https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg"],"description":"BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33748","epss":0.00481,"percentile":0.41545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33748","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33748","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/moby/buildkit","version":"v0.26.3"}},"found":{"vulnerabilityID":"GHSA-4vrq-3vrq-g6gg","versionConstraint":"<0.28.1 (go)"},"fix":{"suggestedVersion":"0.28.1"}}],"artifact":{"id":"pkg:golang/github.com/moby/buildkit@v0.26.3?package-id=89520869a43e0cf3","name":"github.com/moby/buildkit","version":"v0.26.3","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:moby:buildkit:v0.26.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/moby/buildkit@v0.26.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:D+ruZVAk/3ipRq5XRxBH9/DIFpRjSlTtMbghT5gQP9g="}}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.11"],"state":"fixed","available":[{"version":"5.0.11","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=4.0.0,<5.0.11 (semantic)"},"fix":{"suggestedVersion":"5.0.11"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=65bd1222d6c1d651","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6617","dataSource":"https://go.dev/cl/847188","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.3675},"relatedVulnerabilities":[{"id":"CVE-2026-97032","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=24feaffd25f79118","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GHSA-mghh-pgcx-3jjj","dataSource":"https://github.com/advisories/GHSA-mghh-pgcx-3jjj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj","https://nvd.nist.gov/vuln/detail/CVE-2026-101906","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101906","epss":0.00457,"percentile":0.39684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101906","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101906","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.358745},"relatedVulnerabilities":[{"id":"CVE-2026-101906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101906","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101906","epss":0.00457,"percentile":0.39684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101906","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101906","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-mghh-pgcx-3jjj","versionConstraint":">=1.15.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c29m-xwm3-cm6r","dataSource":"https://github.com/advisories/GHSA-c29m-xwm3-cm6r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r","https://nvd.nist.gov/vuln/detail/CVE-2026-101903","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101903","epss":0.00436,"percentile":0.37884,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101903","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34225999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-101903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript regular-expression engine explores many separator placements before rejecting the URL. Synchronous excessive backtracking can block the Node.js event loop and cause denial of service. The affected identifiers are fromDataURI, DATA_URL_PATTERN, data:. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101903","epss":0.00436,"percentile":0.37884,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101903","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-c29m-xwm3-cm6r","versionConstraint":">=1.16.1,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r4gj-5m52-g5wh","dataSource":"https://github.com/advisories/GHSA-r4gj-5m52-g5wh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh","https://nvd.nist.gov/vuln/detail/CVE-2026-101907","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101907","epss":0.00471,"percentile":0.40796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101907","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101907","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.341475},"relatedVulnerabilities":[{"id":"CVE-2026-101907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101907","epss":0.00471,"percentile":0.40796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101907","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101907","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-r4gj-5m52-g5wh","versionConstraint":">=1.17.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.10"],"state":"fixed","available":[{"version":"5.0.10","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=4.0.0,<5.0.10 (semantic)"},"fix":{"suggestedVersion":"5.0.10"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=65bd1222d6c1d651","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"GO-2026-5064","dataSource":"https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc","namespace":"govulndb:language:go","severity":"Critical","urls":[],"description":"containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"exploitabilityScore":3.2,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53492","epss":0.00353,"percentile":0.28925,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53492","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53492","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.32829},"relatedVulnerabilities":[{"id":"CVE-2026-53492","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53492","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc"],"description":"containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"exploitabilityScore":3.2,"impactScore":5.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53492","epss":0.00353,"percentile":0.28925,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53492","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53492","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-33vj-92qq-66hc","dataSource":"https://github.com/advisories/GHSA-33vj-92qq-66hc","namespace":"github:language:go","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc"],"description":"containerd CRI checkpoint restore CDI annotation smuggling","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":8.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53492","epss":0.00353,"percentile":0.28925,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53492","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53492","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GO-2026-5064","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-4hqw-qxg8-jxx2","dataSource":"https://github.com/advisories/GHSA-4hqw-qxg8-jxx2","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","https://nvd.nist.gov/vuln/detail/CVE-2026-101900","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101900","epss":0.00546,"percentile":0.45812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101900","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.32487},"relatedVulnerabilities":[{"id":"CVE-2026-101900","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101900","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101900","epss":0.00546,"percentile":0.45812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101900","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101900","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-4hqw-qxg8-jxx2","versionConstraint":">=1.12.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6354","dataSource":"https://go.dev/issue/81316","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826504","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.\n\nNow, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.32325},"relatedVulnerabilities":[{"id":"CVE-2026-78662","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78662","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826504","https://go.dev/issue/81316","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6354"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.55.0"}},"found":{"vulnerabilityID":"GO-2026-6354","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.55.0?package-id=5e2b0ee5639eb777","name":"golang.org/x/crypto","version":"v0.55.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.55.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.55.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.55.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M="}}},{"vulnerability":{"id":"GO-2026-6610","dataSource":"https://go.dev/cl/835145","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-78660","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=24feaffd25f79118","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GHSA-m8m8-qj5v-23w3","dataSource":"https://github.com/advisories/GHSA-m8m8-qj5v-23w3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3","https://nvd.nist.gov/vuln/detail/CVE-2026-101905","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101905","epss":0.00418,"percentile":0.36131,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101905","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101905","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.31559},"relatedVulnerabilities":[{"id":"CVE-2026-101905","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101905","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request headers and bodies, including credentials, and return attacker-controlled responses while the URL appears legitimate. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101905","epss":0.00418,"percentile":0.36131,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101905","cwe":"CWE-441","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101905","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-m8m8-qj5v-23w3","versionConstraint":">=1.15.2,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-44g4-m2mj-wpvx","dataSource":"https://github.com/advisories/GHSA-44g4-m2mj-wpvx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101899","epss":0.00512,"percentile":0.43695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101899","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.30464},"relatedVulnerabilities":[{"id":"CVE-2026-101899","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101899","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101899","epss":0.00512,"percentile":0.43695,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101899","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-44g4-m2mj-wpvx","versionConstraint":">=1.15.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-375p-5qhx-8wq4","dataSource":"https://github.com/advisories/GHSA-375p-5qhx-8wq4","namespace":"github:language:go","severity":"High","urls":["https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4","https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0"],"description":"Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118650","epss":0.00396,"percentile":0.33876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118650","cwe":"CWE-177","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118650","cwe":"CWE-863","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.16.0"],"state":"fixed","available":[{"version":"4.16.0","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.297},"relatedVulnerabilities":[{"id":"CVE-2026-118650","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118650","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0","https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4"],"description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash resolving to a file under the static root through the global static middleware, but the source is internally inconsistent about whether a route or group guard protects the corresponding literal path in that global-mount configuration. This issue is fixed in 4.16.0 and 5.4.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118650","epss":0.00396,"percentile":0.33876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118650","cwe":"CWE-177","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-118650","cwe":"CWE-863","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-375p-5qhx-8wq4","versionConstraint":"<4.16.0 (go)"},"fix":{"suggestedVersion":"4.16.0"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-h7wr-284f-5qvc","dataSource":"https://github.com/advisories/GHSA-h7wr-284f-5qvc","namespace":"github:language:go","severity":"High","urls":["https://github.com/labstack/echo/security/advisories/GHSA-h7wr-284f-5qvc","https://github.com/labstack/echo/pull/3136","https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","https://github.com/labstack/echo/releases/tag/v4.16.1"],"description":"Echo: Decompress permits unbounded gzip expansion in v4","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118261","epss":0.00372,"percentile":0.31122,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118261","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118261","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.16.1"],"state":"fixed","available":[{"version":"4.16.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29202},"relatedVulnerabilities":[{"id":"CVE-2026-118261","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118261","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","https://github.com/labstack/echo/releases/tag/v4.16.1","https://github.com/labstack/echo/security/advisories/GHSA-h7wr-284f-5qvc"],"description":"Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118261","epss":0.00372,"percentile":0.31122,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118261","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118261","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-h7wr-284f-5qvc","versionConstraint":">=4.0.0,<4.16.1 (go)"},"fix":{"suggestedVersion":"4.16.1"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-f48p-c9v4-h7xv","dataSource":"https://github.com/advisories/GHSA-f48p-c9v4-h7xv","namespace":"github:language:go","severity":"High","urls":["https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv","https://github.com/labstack/echo/pull/3105","https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","https://github.com/labstack/echo/releases/tag/v4.16.1"],"description":"Echo: BodyDump captures request and response bodies without size limits in v4","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118260","epss":0.00372,"percentile":0.31121,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118260","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118260","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.16.1"],"state":"fixed","available":[{"version":"4.16.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29202},"relatedVulnerabilities":[{"id":"CVE-2026-118260","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118260","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","https://github.com/labstack/echo/releases/tag/v4.16.1","https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv"],"description":"Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118260","epss":0.00372,"percentile":0.31121,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118260","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118260","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-f48p-c9v4-h7xv","versionConstraint":">=4.0.0,<4.16.1 (go)"},"fix":{"suggestedVersion":"4.16.1"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-j8rh-479h-cp32","dataSource":"https://github.com/advisories/GHSA-j8rh-479h-cp32","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","https://nvd.nist.gov/vuln/detail/CVE-2026-101904","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Header Injection via Inherited headers After Minimal Interceptor","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101904","epss":0.00488,"percentile":0.42046,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101904","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101904","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.29035999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-101904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101904","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream request processing can observe attacker-controlled headers, including authorization-related values. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101904","epss":0.00488,"percentile":0.42046,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101904","cwe":"CWE-74","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-101904","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-j8rh-479h-cp32","versionConstraint":">=1.0.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-5338","dataSource":"https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574","namespace":"govulndb:language:go","severity":"Critical","urls":[],"description":"containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"exploitabilityScore":3.2,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50195","epss":0.00303,"percentile":0.23137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50195","cwe":"CWE-345","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-50195","cwe":"CWE-829","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.286335},"relatedVulnerabilities":[{"id":"CVE-2026-50195","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50195","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574"],"description":"containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"exploitabilityScore":3.2,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50195","epss":0.00303,"percentile":0.23137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50195","cwe":"CWE-345","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-50195","cwe":"CWE-829","source":"security-advisories@github.com","type":"Primary"}]},{"id":"GHSA-cvxm-645q-p574","dataSource":"https://github.com/advisories/GHSA-cvxm-645q-p574","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574","https://nvd.nist.gov/vuln/detail/CVE-2026-50195"],"description":"containerd: CRI checkpoint import allows local image tag poisoning","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"exploitabilityScore":3.2,"impactScore":6.1},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:L","metrics":{"baseScore":5.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50195","epss":0.00303,"percentile":0.23137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50195","cwe":"CWE-345","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-50195","cwe":"CWE-829","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GO-2026-5338","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-vh66-26gq-q6x8","dataSource":"https://github.com/advisories/GHSA-vh66-26gq-q6x8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","https://nvd.nist.gov/vuln/detail/CVE-2026-101908","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype pollution gadget in fetch adapter can alter outbound requests","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101908","epss":0.00471,"percentile":0.40719,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101908","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.28024499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-101908","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101908","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101908","epss":0.00471,"percentile":0.40719,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101908","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-vh66-26gq-q6x8","versionConstraint":">=1.7.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mgcc-cww5-fp2q","dataSource":"https://github.com/advisories/GHSA-mgcc-cww5-fp2q","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116587","https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6"],"description":"Go JOSE: DoS when parsing JWKs that contain RSA keys","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.6"],"state":"fixed","available":[{"version":"4.1.6","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.2745},"relatedVulnerabilities":[{"id":"CVE-2026-116587","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116587","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6","https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-mgcc-cww5-fp2q","versionConstraint":"<=4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.6"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=41a8099e429d2e26","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GHSA-77fj-vx54-gvh7","dataSource":"https://github.com/advisories/GHSA-77fj-vx54-gvh7","namespace":"github:language:go","severity":"High","urls":["https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7","https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778","https://nvd.nist.gov/vuln/detail/CVE-2026-40890"],"description":"Go Markdown has an Out-of-bounds Read in SmartypantsRenderer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-40890","epss":0.00346,"percentile":0.28154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-40890","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.0.0-20260411013819-759bbc3e3207"],"state":"fixed","available":[{"version":"0.0.0-20260411013819-759bbc3e3207","date":"2026-04-15","kind":"first-observed"}]},"advisories":[],"risk":0.2595},"relatedVulnerabilities":[{"id":"CVE-2026-40890","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40890","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778","https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7"],"description":"The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-40890","epss":0.00346,"percentile":0.28154,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-40890","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/gomarkdown/markdown","version":"v0.0.0-20260217112301-37c66b85d6ab"}},"found":{"vulnerabilityID":"GHSA-77fj-vx54-gvh7","versionConstraint":"<0.0.0-20260411013819-759bbc3e3207 (go)"},"fix":{"suggestedVersion":"0.0.0-20260411013819-759bbc3e3207"}}],"artifact":{"id":"pkg:golang/github.com/gomarkdown/markdown@v0.0.0-20260217112301-37c66b85d6ab?package-id=0f284f1f37691696","name":"github.com/gomarkdown/markdown","version":"v0.0.0-20260217112301-37c66b85d6ab","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:gomarkdown:markdown:v0.0.0-20260217112301-37c66b85d6ab:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/gomarkdown/markdown@v0.0.0-20260217112301-37c66b85d6ab","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:VYNivV7P8IRHUam2swVUNkhIdp0LRRFKe4hXNnoZKTc="}}},{"vulnerability":{"id":"GHSA-9fr6-4gfg-395g","dataSource":"https://github.com/advisories/GHSA-9fr6-4gfg-395g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","https://nvd.nist.gov/vuln/detail/CVE-2026-101902","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0"],"description":"Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101902","epss":0.00414,"percentile":0.35676,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101902","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.0"],"state":"fixed","available":[{"version":"1.20.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.24632999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-101902","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101902","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/releases/tag/v0.34.0","https://github.com/axios/axios/releases/tag/v1.20.0","https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g"],"description":"Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101902","epss":0.00414,"percentile":0.35676,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101902","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"axios","version":"1.18.1"}},"found":{"vulnerabilityID":"GHSA-9fr6-4gfg-395g","versionConstraint":">=1.0.0,<1.20.0 (semantic)"},"fix":{"suggestedVersion":"1.20.0"}}],"artifact":{"id":"pkg:npm/axios@1.18.1?package-id=98b36f39abfa9d27","name":"axios","version":"1.18.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:axios:axios:1.18.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/axios@1.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-pxq6-2prw-chj9","dataSource":"https://github.com/advisories/GHSA-pxq6-2prw-chj9","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9","https://github.com/moby/moby/commit/f4d6f25bf0c3fa12d4968320a45685947756a22a","https://docs.docker.com/engine/extend/legacy_plugins","https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://nvd.nist.gov/vuln/detail/CVE-2026-33997"],"description":"Moby has an Off-by-one error in its plugin privilege validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33997","epss":0.00402,"percentile":0.34439,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33997","cwe":"CWE-193","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33997","cwe":"CWE-266","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.23717999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-33997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33997","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/security/cve/CVE-2026-33997","https://bugzilla.redhat.com/show_bug.cgi?id=2453277","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33997.json"],"description":"Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":1.7,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33997","epss":0.00402,"percentile":0.34439,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33997","cwe":"CWE-193","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33997","cwe":"CWE-266","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-pxq6-2prw-chj9","versionConstraint":"<29.3.1 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3b44c4726d0f371d","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-9969-6676-49h5","dataSource":"https://github.com/advisories/GHSA-9969-6676-49h5","namespace":"github:language:go","severity":"High","urls":["https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5","https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec","https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","https://github.com/labstack/echo/releases/tag/v4.16.1","https://github.com/labstack/echo/releases/tag/v5.4.1"],"description":"Echo: WebSocket proxy can retain connections and handlers after client disconnect","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118262","epss":0.00302,"percentile":0.22936,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118262","cwe":"CWE-772","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.16.1"],"state":"fixed","available":[{"version":"4.16.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.23707},"relatedVulnerabilities":[{"id":"CVE-2026-118262","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118262","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec","https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","https://github.com/labstack/echo/releases/tag/v4.16.1","https://github.com/labstack/echo/releases/tag/v5.4.1","https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5"],"description":"Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118262","epss":0.00302,"percentile":0.22936,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118262","cwe":"CWE-772","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-9969-6676-49h5","versionConstraint":">=4.15.0,<4.16.1 (go)"},"fix":{"suggestedVersion":"4.16.1"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GO-2026-6180","dataSource":"https://go.dev/issue/80745","namespace":"govulndb:language:go","severity":"High","urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/815000","https://go.dev/cl/815020"],"description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.\n\nThis attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56864","epss":0.00298,"percentile":0.22508,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56864","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.40.0"],"state":"fixed","available":[{"version":"0.40.0","date":"2026-08-13","kind":"release"}]},"advisories":[],"risk":0.2235},"relatedVulnerabilities":[{"id":"CVE-2026-56864","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56864","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/815000","https://go.dev/cl/815020","https://go.dev/issue/80745","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6180"],"description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56864","epss":0.00298,"percentile":0.22508,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56864","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/mod","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-6180","versionConstraint":"<0.40.0 (go)"},"fix":{"suggestedVersion":"0.40.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/mod@v0.38.0?package-id=6e58088d85126f6b","name":"golang.org/x/mod","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:x\\/mod:v0.38.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/mod@v0.38.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.12"],"state":"fixed","available":[{"version":"5.0.12","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=4.0.0,<5.0.12 (semantic)"},"fix":{"suggestedVersion":"5.0.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=65bd1222d6c1d651","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-33481","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33481","namespace":"nvd:language:go","severity":"Medium","urls":["https://github.com/anchore/stereoscope/pull/537","https://github.com/anchore/syft/pull/4629","https://github.com/anchore/syft/pull/4668","https://github.com/anchore/syft/security/advisories/GHSA-rjcw-vg7j-m9rc"],"description":"Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Syft versions before v1.42.3 would not properly cleanup temporary storage if the temporary storage was exhausted during a scan. When scanning archives Syft will unpack those archives into temporary storage then inspect the unpacked contents. Under normal operation Syft will remove the temporary data it writes after completing a scan. This vulnerability would affect users of Syft that were scanning content that could cause Syft to fill the temporary storage that would then cause Syft to raise an error and exit. When the error is triggered Syft would exit without properly removing the temporary files in use. In our testing this was most easily reproduced by scanning very large artifacts or highly compressed artifacts such as a zipbomb. Because Syft would not clean up its temporary files, the result would be filling temporary file storage preventing future runs of Syft or other system utilities that rely on temporary storage being available. The patch has been released in v1.42.3. Syft now cleans up temporary files when an error condition is encountered. There are no workarounds for this vulnerability in Syft. Users that find their temporary storage depleted can manually remove the temporary files.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33481","epss":0.00423,"percentile":0.36685,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33481","cwe":"CWE-460","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.42.3"],"state":"fixed","available":[{"version":"1.42.3","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"nvd:language:go","package":{"name":"github.com/anchore/syft","version":"v1.40.0"}},"found":{"vulnerabilityID":"CVE-2026-33481","versionConstraint":"< 1.42.3 (go)"},"fix":{"suggestedVersion":"1.42.3"}}],"artifact":{"id":"pkg:golang/github.com/anchore/syft@v1.40.0?package-id=b272b0529c52d05a","name":"github.com/anchore/syft","version":"v1.40.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:anchore:syft:v1.40.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/anchore/syft@v1.40.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ZvSIk0QPW78G4LPVxTC+xjLZZz3fBAKeCD5zafdzcgE="}}},{"vulnerability":{"id":"GHSA-rjcw-vg7j-m9rc","dataSource":"https://github.com/advisories/GHSA-rjcw-vg7j-m9rc","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/anchore/syft/security/advisories/GHSA-rjcw-vg7j-m9rc","https://github.com/anchore/stereoscope/pull/537","https://github.com/anchore/syft/pull/4629","https://github.com/anchore/syft/pull/4668","https://nvd.nist.gov/vuln/detail/CVE-2026-33481"],"description":"Syft improper temporary file cleanup","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33481","epss":0.00423,"percentile":0.36685,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33481","cwe":"CWE-460","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.42.3"],"state":"fixed","available":[{"version":"1.42.3","date":"2026-03-21","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2026-33481","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33481","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/anchore/stereoscope/pull/537","https://github.com/anchore/syft/pull/4629","https://github.com/anchore/syft/pull/4668","https://github.com/anchore/syft/security/advisories/GHSA-rjcw-vg7j-m9rc"],"description":"Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Syft versions before v1.42.3 would not properly cleanup temporary storage if the temporary storage was exhausted during a scan. When scanning archives Syft will unpack those archives into temporary storage then inspect the unpacked contents. Under normal operation Syft will remove the temporary data it writes after completing a scan. This vulnerability would affect users of Syft that were scanning content that could cause Syft to fill the temporary storage that would then cause Syft to raise an error and exit. When the error is triggered Syft would exit without properly removing the temporary files in use. In our testing this was most easily reproduced by scanning very large artifacts or highly compressed artifacts such as a zipbomb. Because Syft would not clean up its temporary files, the result would be filling temporary file storage preventing future runs of Syft or other system utilities that rely on temporary storage being available. The patch has been released in v1.42.3. Syft now cleans up temporary files when an error condition is encountered. There are no workarounds for this vulnerability in Syft. Users that find their temporary storage depleted can manually remove the temporary files.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33481","epss":0.00423,"percentile":0.36685,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33481","cwe":"CWE-460","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/anchore/syft","version":"v1.40.0"}},"found":{"vulnerabilityID":"GHSA-rjcw-vg7j-m9rc","versionConstraint":"<1.42.3 (go)"},"fix":{"suggestedVersion":"1.42.3"}}],"artifact":{"id":"pkg:golang/github.com/anchore/syft@v1.40.0?package-id=b272b0529c52d05a","name":"github.com/anchore/syft","version":"v1.40.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:anchore:syft:v1.40.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/anchore/syft@v1.40.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ZvSIk0QPW78G4LPVxTC+xjLZZz3fBAKeCD5zafdzcgE="}}},{"vulnerability":{"id":"GHSA-246p-cpwv-v3jq","dataSource":"https://github.com/advisories/GHSA-246p-cpwv-v3jq","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq","https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2","https://github.com/labstack/echo/releases/tag/v5.1.0"],"description":"Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118653","epss":0.00415,"percentile":0.35846,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118653","cwe":"CWE-290","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-118653","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118653","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2","https://github.com/labstack/echo/releases/tag/v5.1.0","https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq"],"description":"Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling used for controls such as brute-force or request-volume protection. This issue is fixed in Echo v5.1.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118653","epss":0.00415,"percentile":0.35846,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118653","cwe":"CWE-290","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-246p-cpwv-v3jq","versionConstraint":">=4.0.0,<=4.16.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-pg57-6jwg-q645","dataSource":"https://github.com/advisories/GHSA-pg57-6jwg-q645","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645","https://nvd.nist.gov/vuln/detail/CVE-2026-53493","https://github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619fe","https://github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8","https://github.com/containerd/containerd/releases/tag/v1.7.36","https://github.com/containerd/containerd/releases/tag/v2.0.13","https://github.com/containerd/containerd/releases/tag/v2.2.9","https://github.com/containerd/containerd/releases/tag/v2.3.6","https://github.com/containerd/containerd/releases/tag/v2.4.1"],"description":"Containerd has image-pull DoS via crafted OCI index graph amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53493","epss":0.00356,"percentile":0.29379,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53493","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53493","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53493","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.36"],"state":"fixed","available":[{"version":"1.7.36","date":"2026-09-26","kind":"first-observed"}]},"advisories":[],"risk":0.21181999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-53493","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53493","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645"],"description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53493","epss":0.00356,"percentile":0.29379,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53493","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53493","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53493","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-pg57-6jwg-q645","versionConstraint":"<=1.7.35 (go)"},"fix":{"suggestedVersion":"1.7.36"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-cv23-7vc5-jfh7","dataSource":"https://github.com/advisories/GHSA-cv23-7vc5-jfh7","namespace":"github:language:go","severity":"High","urls":["https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7","https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9"],"description":"gomarkdown/markdown IsSafeURL panics on short URLs","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102941","epss":0.00279,"percentile":0.20376,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102941","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.0.0-20260724235538-61af6e1e6971"],"state":"fixed","available":[{"version":"0.0.0-20260724235538-61af6e1e6971","date":"2026-10-16","kind":"first-observed"}]},"advisories":[],"risk":0.20924999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-102941","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102941","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9","https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7"],"description":"The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longer prefix is sliced. Demonstrated panic cases include empty, ., and .. destinations under those conditions. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and is also reachable by callers that pass a short attacker-controlled URL directly to the exported parser.IsSafeURL function. An uncaught panic can terminate the calling process and cause denial of service. This issue is fixed in 0.0.0-20260724235538-61af6e1e6971.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102941","epss":0.00279,"percentile":0.20376,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102941","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/gomarkdown/markdown","version":"v0.0.0-20260217112301-37c66b85d6ab"}},"found":{"vulnerabilityID":"GHSA-cv23-7vc5-jfh7","versionConstraint":"<0.0.0-20260724235538-61af6e1e6971 (go)"},"fix":{"suggestedVersion":"0.0.0-20260724235538-61af6e1e6971"}}],"artifact":{"id":"pkg:golang/github.com/gomarkdown/markdown@v0.0.0-20260217112301-37c66b85d6ab?package-id=0f284f1f37691696","name":"github.com/gomarkdown/markdown","version":"v0.0.0-20260217112301-37c66b85d6ab","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:gomarkdown:markdown:v0.0.0-20260217112301-37c66b85d6ab:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/gomarkdown/markdown@v0.0.0-20260217112301-37c66b85d6ab","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:VYNivV7P8IRHUam2swVUNkhIdp0LRRFKe4hXNnoZKTc="}}},{"vulnerability":{"id":"GHSA-vvgj-x9jq-8cj9","dataSource":"https://github.com/advisories/GHSA-vvgj-x9jq-8cj9","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9","https://github.com/quic-go/quic-go/pull/5642","https://github.com/quic-go/quic-go/commit/c56e8c79d1627cc1ed6005b421b4b0adadd83665","https://github.com/advisories/GHSA-g754-hx8w-x2g6","https://github.com/quic-go/quic-go/releases/tag/v0.59.1","https://nvd.nist.gov/vuln/detail/CVE-2026-40898"],"description":"quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-40898","epss":0.00396,"percentile":0.33792,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-40898","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.59.1"],"state":"fixed","available":[{"version":"0.59.1","date":"2026-06-04","kind":"first-observed"}]},"advisories":[],"risk":0.20394},"relatedVulnerabilities":[{"id":"CVE-2026-40898","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40898","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/quic-go/quic-go/releases/tag/v0.59.1","https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9"],"description":"quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS frame, not on the decoded field section. This can lead to memory exhaustion. This is very similar to CVE-2025-64702. The difference is that this issue uses HTTP trailers, rather than HTTP headers, as the attack vector. A misbehaving or malicious peer can cause a denial-of-service (DoS) attack against quic-go's HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or resource exhaustion. This affects both servers and clients due to symmetric header construction. Version 0.59.1 enforces RFC 9114 decoded field section size limits for trailers as well. It incrementally decodes QPACK entries and checks the field section size after each entry, aborting the stream if an entry causes the limit to be exceeded.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-40898","epss":0.00396,"percentile":0.33792,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-40898","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/quic-go/quic-go","version":"v0.59.0"}},"found":{"vulnerabilityID":"GHSA-vvgj-x9jq-8cj9","versionConstraint":"<=0.59.0 (go)"},"fix":{"suggestedVersion":"0.59.1"}}],"artifact":{"id":"pkg:golang/github.com/quic-go/quic-go@v0.59.0?package-id=5307381216f32002","name":"github.com/quic-go/quic-go","version":"v0.59.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:quic-go:quic-go:v0.59.0:*:*:*:*:*:*:*","cpe:2.3:a:quic-go:quic_go:v0.59.0:*:*:*:*:*:*:*","cpe:2.3:a:quic_go:quic-go:v0.59.0:*:*:*:*:*:*:*","cpe:2.3:a:quic_go:quic_go:v0.59.0:*:*:*:*:*:*:*","cpe:2.3:a:quic:quic-go:v0.59.0:*:*:*:*:*:*:*","cpe:2.3:a:quic:quic_go:v0.59.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/quic-go/quic-go@v0.59.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw="}}},{"vulnerability":{"id":"GHSA-mrwp-f3q8-3g9p","dataSource":"https://github.com/advisories/GHSA-mrwp-f3q8-3g9p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p","https://nvd.nist.gov/vuln/detail/CVE-2026-116689","https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2"],"description":"follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.2"],"state":"fixed","available":[{"version":"1.16.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.193515},"relatedVulnerabilities":[{"id":"CVE-2026-116689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116689","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8","https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p"],"description":"follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116689","epss":0.00266,"percentile":0.18805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116689","cwe":"CWE-201","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.16.0"}},"found":{"vulnerabilityID":"GHSA-mrwp-f3q8-3g9p","versionConstraint":">=1.16.0,<=1.16.1 (semantic)"},"fix":{"suggestedVersion":"1.16.2"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.16.0?package-id=9cf253eed2043b51","name":"follow-redirects","version":"1.16.0","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3pmx-cf9f-34xr","dataSource":"https://github.com/advisories/GHSA-3pmx-cf9f-34xr","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr","https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0"],"description":"Echo static file middleware route protection bypass via encoded dot-dot traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118654","epss":0.00347,"percentile":0.28272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118654","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.16.0"],"state":"fixed","available":[{"version":"4.16.0","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.189115},"relatedVulnerabilities":[{"id":"CVE-2026-118654","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118654","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0","https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr"],"description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization. This vulnerability is the result of an incomplete fix for CVE-2026-55677. This issue is fixed in 4.16.0 and 5.4.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118654","epss":0.00347,"percentile":0.28272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118654","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-3pmx-cf9f-34xr","versionConstraint":"<4.16.0 (go)"},"fix":{"suggestedVersion":"4.16.0"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-7236-3392-c5c6","dataSource":"https://github.com/advisories/GHSA-7236-3392-c5c6","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6"],"description":"BuildKit: Custom frontend could bypass Seccomp/AppArmor","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61711","epss":0.00357,"percentile":0.29455,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61711","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-08-20","kind":"first-observed"}]},"advisories":[],"risk":0.183855},"relatedVulnerabilities":[{"id":"CVE-2026-61711","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61711","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/moby/buildkit/commit/3ea6dd0ce7d269cdb8aa23348718e2c1bf64f109","https://github.com/moby/buildkit/commit/64bbec89ca43dd95b2853edeca240c33c6729910","https://github.com/moby/buildkit/releases/tag/v0.31.1","https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6"],"description":"BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for the build container even though Linux capabilities remained restricted. This issue is fixed in version 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61711","epss":0.00357,"percentile":0.29455,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61711","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/moby/buildkit","version":"v0.26.3"}},"found":{"vulnerabilityID":"GHSA-7236-3392-c5c6","versionConstraint":"<=0.31.0 (go)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:golang/github.com/moby/buildkit@v0.26.3?package-id=89520869a43e0cf3","name":"github.com/moby/buildkit","version":"v0.26.3","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:moby:buildkit:v0.26.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/moby/buildkit@v0.26.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:D+ruZVAk/3ipRq5XRxBH9/DIFpRjSlTtMbghT5gQP9g="}}},{"vulnerability":{"id":"GHSA-vvm8-gf78-28g4","dataSource":"https://github.com/advisories/GHSA-vvm8-gf78-28g4","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4","https://nvd.nist.gov/vuln/detail/CVE-2026-116586","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panics in JSON parsing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.17373999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-116586","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116586","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-vvm8-gf78-28g4","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=41a8099e429d2e26","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"10.2.5"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@10.2.5?package-id=73c1acf8d5125e44","name":"minimatch","version":"10.2.5","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:10.2.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@10.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-xwq5-6cqp-vx96","dataSource":"https://github.com/advisories/GHSA-xwq5-6cqp-vx96","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96","https://github.com/labstack/echo/issues/2599","https://github.com/labstack/echo/pull/3006","https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6","https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725","https://github.com/labstack/echo/releases/tag/v4.15.3","https://github.com/labstack/echo/releases/tag/v5.2.0"],"description":"Echo has a Static Middleware Double-Unescape Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118655","epss":0.00303,"percentile":0.23121,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118655","cwe":"CWE-174","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.15.3"],"state":"fixed","available":[{"version":"4.15.3","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.16513500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-118655","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118655","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6","https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725","https://github.com/labstack/echo/issues/2599","https://github.com/labstack/echo/pull/3006","https://github.com/labstack/echo/releases/tag/v4.15.3","https://github.com/labstack/echo/releases/tag/v5.2.0","https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96"],"description":"Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118655","epss":0.00303,"percentile":0.23121,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118655","cwe":"CWE-174","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-xwq5-6cqp-vx96","versionConstraint":"<4.15.3 (go)"},"fix":{"suggestedVersion":"4.15.3"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-jpcc-p29g-p8mq","dataSource":"https://github.com/advisories/GHSA-jpcc-p29g-p8mq","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq"],"description":"containerd image-triggered runtime DoS via unbounded group parsing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47262","epss":0.00265,"percentile":0.18462,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47262","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.7.33"],"state":"fixed","available":[{"version":"1.7.33","date":"2026-06-20","kind":"first-observed"}]},"advisories":[],"risk":0.157675},"relatedVulnerabilities":[{"id":"CVE-2026-47262","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47262","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq"],"description":"containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47262","epss":0.00265,"percentile":0.18462,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47262","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-jpcc-p29g-p8mq","versionConstraint":">=1.7.0,<1.7.33 (go)"},"fix":{"suggestedVersion":"1.7.33"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-4w3g-jfj2-cw2q","dataSource":"https://github.com/advisories/GHSA-4w3g-jfj2-cw2q","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116585","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panic during CBC-HMAC processing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.15708},"relatedVulnerabilities":[{"id":"CVE-2026-116585","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116585","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows the empty buffer to be indexed, causing a panic and denial of service. Applications that decrypt attacker-controlled ciphertext with one of these content-encryption algorithms are affected. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"}},"found":{"vulnerabilityID":"GHSA-4w3g-jfj2-cw2q","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4?package-id=41a8099e429d2e26","name":"github.com/go-jose/go-jose/v4","version":"v4.1.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA="}}},{"vulnerability":{"id":"GO-2026-5320","dataSource":"https://github.com/advisories/GHSA-c97m-vxhj-p7j6","namespace":"govulndb:language:go","severity":"Medium","urls":["https://github.com/yuin/goldmark/commit/cb46bbc4eca29d55aa9721e04ad207c23ccc44f9","https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMYUINGOLDMARKRENDERERHTML-15838406"],"description":"Cross-site Scripting (XSS) in github.com/yuin/goldmark","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-5160","epss":0.00287,"percentile":0.21228,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-5160","cwe":"CWE-79","source":"report@snyk.io","type":"Secondary"}],"fix":{"versions":["1.7.17"],"state":"fixed","available":[{"version":"1.7.17","date":"2026-03-19","kind":"release"}]},"advisories":[],"risk":0.144935},"relatedVulnerabilities":[{"id":"CVE-2026-5160","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5160","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/yuin/goldmark/commit/cb46bbc4eca29d55aa9721e04ad207c23ccc44f9","https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMYUINGOLDMARKRENDERERHTML-15838406"],"description":"Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript&colon;alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-5160","epss":0.00287,"percentile":0.21228,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-5160","cwe":"CWE-79","source":"report@snyk.io","type":"Secondary"}]},{"id":"GHSA-c97m-vxhj-p7j6","dataSource":"https://github.com/advisories/GHSA-c97m-vxhj-p7j6","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-5160","https://github.com/yuin/goldmark/commit/cb46bbc4eca29d55aa9721e04ad207c23ccc44f9","https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMYUINGOLDMARKRENDERERHTML-15838406"],"description":"goldmark vulnerable to Cross-site Scripting (XSS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-5160","epss":0.00287,"percentile":0.21228,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-5160","cwe":"CWE-79","source":"report@snyk.io","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/yuin/goldmark","version":"v1.7.16"}},"found":{"vulnerabilityID":"GO-2026-5320","versionConstraint":"<1.7.17 (go)"},"fix":{"suggestedVersion":"1.7.17"}}],"artifact":{"id":"pkg:golang/github.com/yuin/goldmark@v1.7.16?package-id=eb926cddc23b9d56","name":"github.com/yuin/goldmark","version":"v1.7.16","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:yuin:goldmark:v1.7.16:*:*:*:*:go:*:*"],"purl":"pkg:golang/github.com/yuin/goldmark@v1.7.16","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:n+CJdUxaFMiDUNnWC3dMWCIQJSkxH4uz3ZwQBkAlVNE="}}},{"vulnerability":{"id":"GHSA-xhf5-7wjv-pqxp","dataSource":"https://github.com/advisories/GHSA-xhf5-7wjv-pqxp","namespace":"github:language:go","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"],"description":"containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53488","epss":0.00176,"percentile":0.07132,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53488","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.33"],"state":"fixed","available":[{"version":"1.7.33","date":"2026-06-20","kind":"first-observed"}]},"advisories":[],"risk":0.14256},"relatedVulnerabilities":[{"id":"CVE-2026-53488","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53488","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"],"description":"containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53488","epss":0.00176,"percentile":0.07132,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53488","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-xhf5-7wjv-pqxp","versionConstraint":">=1.7.0,<1.7.33 (go)"},"fix":{"suggestedVersion":"1.7.33"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-h9g5-28mm-hx3g","dataSource":"https://github.com/advisories/GHSA-h9g5-28mm-hx3g","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g","https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0"],"description":"Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118652","epss":0.00239,"percentile":0.15057,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118652","cwe":"CWE-79","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.16.0"],"state":"fixed","available":[{"version":"4.16.0","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.132645},"relatedVulnerabilities":[{"id":"CVE-2026-118652","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118652","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0","https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g"],"description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118652","epss":0.00239,"percentile":0.15057,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118652","cwe":"CWE-79","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-h9g5-28mm-hx3g","versionConstraint":"<4.16.0 (go)"},"fix":{"suggestedVersion":"4.16.0"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-685w-q87j-wqw3","dataSource":"https://github.com/advisories/GHSA-685w-q87j-wqw3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3","https://nvd.nist.gov/vuln/detail/CVE-2026-85747","https://github.com/distribution/distribution/commit/8f91c26c8888a95a36c2357a6e30bc15d4dd76d3","https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2"],"description":"Distribution: Client `manifests.Get()` does not verify returned content against requested digest","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.12861999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-85747","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85747","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2","https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3"],"description":"Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/distribution","version":"v2.8.3+incompatible"}},"found":{"vulnerabilityID":"GHSA-685w-q87j-wqw3","versionConstraint":"<=2.8.3 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible?package-id=3ecf5daaa007448a","name":"github.com/docker/distribution","version":"v2.8.3+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:distribution:v2.8.3\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk="}}},{"vulnerability":{"id":"GHSA-fqw6-gf59-qr4w","dataSource":"https://github.com/advisories/GHSA-fqw6-gf59-qr4w","namespace":"github:language:go","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w","https://nvd.nist.gov/vuln/detail/CVE-2026-46680"],"description":"containerd user ID handling bypass allows runAsNonRoot evasion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46680","epss":0.00163,"percentile":0.05457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46680","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.32"],"state":"fixed","available":[{"version":"1.7.32","date":"2026-05-22","kind":"first-observed"}]},"advisories":[],"risk":0.12265749999999999},"relatedVulnerabilities":[{"id":"CVE-2026-46680","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46680","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w"],"description":"containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46680","epss":0.00163,"percentile":0.05457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46680","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-fqw6-gf59-qr4w","versionConstraint":">=1.7.27,<1.7.32 (go)"},"fix":{"suggestedVersion":"1.7.32"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-x86f-5xw2-fm2r","dataSource":"https://github.com/advisories/GHSA-x86f-5xw2-fm2r","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r","https://nvd.nist.gov/vuln/detail/CVE-2026-41567"],"description":"Docker: `PUT /containers/{id}/archive` executes container binary on the host","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41567","epss":0.00155,"percentile":0.04597,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.11392499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-41567","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41567","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/security/cve/CVE-2026-41567","https://bugzilla.redhat.com/show_bug.cgi?id=2485356","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json"],"description":"Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":0.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41567","epss":0.00155,"percentile":0.04597,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-x86f-5xw2-fm2r","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3b44c4726d0f371d","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-w3vv-58gj-gw77","dataSource":"https://github.com/advisories/GHSA-w3vv-58gj-gw77","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nrwl/nx/security/advisories/GHSA-w3vv-58gj-gw77","https://nvd.nist.gov/vuln/detail/CVE-2026-104854","https://github.com/nrwl/nx/pull/36370","https://github.com/nrwl/nx/commit/3298fd8b2dd066167eb3cc0410643994a59b0bba","https://github.com/nrwl/nx/commit/63e1abb287a3d69f8ba981828a1de325d0d3dc68","https://github.com/nrwl/nx/commit/71c2253b6aac23b008e192c4e2642c42a5e07545","https://github.com/nrwl/nx/releases/tag/22.7.9","https://github.com/nrwl/nx/releases/tag/23.1.2"],"description":"Nx daemon and plugin worker sockets are accessible to other local users","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104854","epss":0.00142,"percentile":0.03444,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104854","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104854","cwe":"CWE-732","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["23.1.2"],"state":"fixed","available":[{"version":"23.1.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.1136},"relatedVulnerabilities":[{"id":"CVE-2026-104854","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104854","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nrwl/nx/commit/3298fd8b2dd066167eb3cc0410643994a59b0bba","https://github.com/nrwl/nx/commit/63e1abb287a3d69f8ba981828a1de325d0d3dc68","https://github.com/nrwl/nx/commit/71c2253b6aac23b008e192c4e2642c42a5e07545","https://github.com/nrwl/nx/pull/36370","https://github.com/nrwl/nx/releases/tag/22.7.9","https://github.com/nrwl/nx/releases/tag/23.1.2","https://github.com/nrwl/nx/security/advisories/GHSA-w3vv-58gj-gw77"],"description":"Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on a shared build server, developer host, or multi-user container can discover and connect to a running socket because the transport performs no authentication and relies on filesystem containment. The daemon's PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that controls a file to execute code as the account running Nx; other handlers can expose workspace file contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable plugin-worker sockets, while single-user machines without another local account are not exposed. This issue is fixed in versions 22.7.9 and 23.1.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104854","epss":0.00142,"percentile":0.03444,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104854","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104854","cwe":"CWE-732","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nx","version":"23.1.1"}},"found":{"vulnerabilityID":"GHSA-w3vv-58gj-gw77","versionConstraint":">=23.0.0,<23.1.2 (semantic)"},"fix":{"suggestedVersion":"23.1.2"}}],"artifact":{"id":"pkg:npm/nx@23.1.1?package-id=52cc11438d048f9e","name":"nx","version":"23.1.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nx:nx:23.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/nx@23.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-v753-g4cw-jm48","dataSource":"https://github.com/advisories/GHSA-v753-g4cw-jm48","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48","https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0"],"description":"Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118656","epss":0.00197,"percentile":0.09448,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118656","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.16.0"],"state":"fixed","available":[{"version":"4.16.0","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.10933499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118656","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118656","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0","https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48"],"description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118656","epss":0.00197,"percentile":0.09448,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118656","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-v753-g4cw-jm48","versionConstraint":"<4.16.0 (go)"},"fix":{"suggestedVersion":"4.16.0"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-rp3h-jf77-q9p4","dataSource":"https://github.com/advisories/GHSA-rp3h-jf77-q9p4","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4","https://nvd.nist.gov/vuln/detail/CVE-2026-95838","https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0"],"description":"containerd: Unpack DoS via repeated opaque whiteouts","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":4.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95838","epss":0.00223,"percentile":0.12963,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-95838","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-95838","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.35"],"state":"fixed","available":[{"version":"1.7.35","date":"2026-10-16","kind":"first-observed"}]},"advisories":[],"risk":0.10704},"relatedVulnerabilities":[{"id":"CVE-2026-95838","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95838","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0","https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4"],"description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95838","epss":0.00223,"percentile":0.12963,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-95838","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-95838","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-rp3h-jf77-q9p4","versionConstraint":"<1.7.35 (go)"},"fix":{"suggestedVersion":"1.7.35"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-99jh-6h7p-pp36","dataSource":"https://github.com/advisories/GHSA-99jh-6h7p-pp36","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v5.4.0"],"description":"Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118651","epss":0.00207,"percentile":0.1081,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118651","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.106605},"relatedVulnerabilities":[{"id":"CVE-2026-118651","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118651","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v5.4.0","https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36"],"description":"Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118651","epss":0.00207,"percentile":0.1081,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118651","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-99jh-6h7p-pp36","versionConstraint":">=4.0.0,<=4.16.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-72x6-4j93-7w86","dataSource":"https://github.com/advisories/GHSA-72x6-4j93-7w86","namespace":"github:language:go","severity":"Low","urls":["https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86","https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1","https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255","https://github.com/moby/buildkit/releases/tag/v0.31.1"],"description":"BuildKit has a possible runtime DoS via unbounded group parsing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61712","epss":0.00399,"percentile":0.34096,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61712","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.31.1"],"state":"fixed","available":[{"version":"0.31.1","date":"2026-08-20","kind":"first-observed"}]},"advisories":[],"risk":0.10573499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-61712","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61712","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1","https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255","https://github.com/moby/buildkit/releases/tag/v0.31.1","https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86"],"description":"BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61712","epss":0.00399,"percentile":0.34096,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61712","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/moby/buildkit","version":"v0.26.3"}},"found":{"vulnerabilityID":"GHSA-72x6-4j93-7w86","versionConstraint":"<=0.31.0 (go)"},"fix":{"suggestedVersion":"0.31.1"}}],"artifact":{"id":"pkg:golang/github.com/moby/buildkit@v0.26.3?package-id=89520869a43e0cf3","name":"github.com/moby/buildkit","version":"v0.26.3","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:moby:buildkit:v0.26.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/moby/buildkit@v0.26.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:D+ruZVAk/3ipRq5XRxBH9/DIFpRjSlTtMbghT5gQP9g="}}},{"vulnerability":{"id":"GO-2026-6179","dataSource":"https://go.dev/issue/80744","namespace":"govulndb:language:go","severity":"High","urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/814960","https://go.dev/cl/815020"],"description":"A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.\n\nThis attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.\n\nAll tiles are now correctly verified against their parents.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56865","epss":0.00129,"percentile":0.02529,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56865","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.40.0"],"state":"fixed","available":[{"version":"0.40.0","date":"2026-08-13","kind":"release"}]},"advisories":[],"risk":0.10255500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-56865","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56865","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/814960","https://go.dev/cl/815020","https://go.dev/issue/80744","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6179"],"description":"A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56865","epss":0.00129,"percentile":0.02529,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56865","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/mod","version":"v0.38.0"}},"found":{"vulnerabilityID":"GO-2026-6179","versionConstraint":"<0.40.0 (go)"},"fix":{"suggestedVersion":"0.40.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/mod@v0.38.0?package-id=6e58088d85126f6b","name":"golang.org/x/mod","version":"v0.38.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:x\\/mod:v0.38.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/mod@v0.38.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GO-2026-6866","dataSource":"https://go.dev/cl/855121","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.101},"relatedVulnerabilities":[{"id":"CVE-2026-97045","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=24feaffd25f79118","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GO-2026-5622","dataSource":"https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388","namespace":"govulndb:language:go","severity":"Medium","urls":[],"description":"Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.1,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53489","epss":0.00174,"percentile":0.06877,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53489","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.10004999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-53489","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53489","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388"],"description":"containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.1,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53489","epss":0.00174,"percentile":0.06877,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53489","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-rgh6-rfwx-v388","dataSource":"https://github.com/advisories/GHSA-rgh6-rfwx-v388","namespace":"github:language:go","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388"],"description":"Arbitrary host CRI log file read via symlink following in CRI checkpoint restore","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53489","epss":0.00174,"percentile":0.06877,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53489","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GO-2026-5622","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-7jxh-36q5-gcqv","dataSource":"https://github.com/advisories/GHSA-7jxh-36q5-gcqv","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv","https://github.com/containerd/containerd/releases/tag/v1.7.35","https://github.com/containerd/containerd/releases/tag/v2.0.12","https://github.com/containerd/containerd/releases/tag/v2.2.8","https://github.com/containerd/containerd/releases/tag/v2.3.5"],"description":"containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53495","epss":0.00162,"percentile":0.05327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53495","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.7.35"],"state":"fixed","available":[{"version":"1.7.35","date":"2026-09-10","kind":"first-observed"}]},"advisories":[],"risk":0.09558},"relatedVulnerabilities":[{"id":"CVE-2026-53495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53495","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/containerd/containerd/commit/22ccf4314d1fe0834f8e28f10d37d5305ef9880c","https://github.com/containerd/containerd/commit/5a2a3a759b0d2ad8c821b33c3afc20890daf6d81","https://github.com/containerd/containerd/commit/9ec55f024041d0641f6d79841e45c8781141ddaa","https://github.com/containerd/containerd/commit/eebea8c4c912f44b656c8295c9e6607a19b76650","https://github.com/containerd/containerd/commit/ff39a972369e2f12fae561a58d658bbf8f2bc318","https://github.com/containerd/containerd/releases/tag/v2.0.12","https://github.com/containerd/containerd/releases/tag/v2.2.8","https://github.com/containerd/containerd/releases/tag/v2.3.5","https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv"],"description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53495","epss":0.00162,"percentile":0.05327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53495","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-7jxh-36q5-gcqv","versionConstraint":"<1.7.35 (go)"},"fix":{"suggestedVersion":"1.7.35"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-hrvq-x7jp-36xv","dataSource":"https://github.com/advisories/GHSA-hrvq-x7jp-36xv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nrwl/nx/security/advisories/GHSA-hrvq-x7jp-36xv","https://nvd.nist.gov/vuln/detail/CVE-2026-104853","https://github.com/nrwl/nx/pull/36887","https://github.com/nrwl/nx/commit/38cd82a0c05e8212e538bdb87ccb198d6504e58f","https://github.com/nrwl/nx/commit/95474ab457e8e1dbdbefad29040c166105a8fb90","https://github.com/nrwl/nx/commit/de37c5ebd1852fac700d70726326236ac398af3f","https://github.com/nrwl/nx/releases/tag/22.7.10","https://github.com/nrwl/nx/releases/tag/23.2.1"],"description":"Nx: Path traversal in nx migrate package-migrations extraction","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104853","epss":0.00172,"percentile":0.06561,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104853","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104853","cwe":"CWE-73","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["23.2.1"],"state":"fixed","available":[{"version":"23.2.1","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.09288},"relatedVulnerabilities":[{"id":"CVE-2026-104853","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104853","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nrwl/nx/commit/38cd82a0c05e8212e538bdb87ccb198d6504e58f","https://github.com/nrwl/nx/commit/95474ab457e8e1dbdbefad29040c166105a8fb90","https://github.com/nrwl/nx/commit/de37c5ebd1852fac700d70726326236ac398af3f","https://github.com/nrwl/nx/pull/36887","https://github.com/nrwl/nx/releases/tag/22.7.10","https://github.com/nrwl/nx/releases/tag/23.2.1","https://github.com/nrwl/nx/security/advisories/GHSA-hrvq-x7jp-36xv"],"description":"Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package introduced through a trusted package's packageGroup can supply .. segments or an absolute path, causing nx migrate to join an escaping destination onto its temporary directory. The migration archive can then write attacker-controlled bytes outside the temporary directory, while opening the destination stream can truncate an existing writable file even when no archive entry matches. This occurs during migration planning before review of the migration list or use of --run-migrations; the vulnerable installed Nx copy is reached when the normal nx@latest handoff is bypassed with NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or fallback after a temporary-install failure. This issue is fixed in versions 22.7.10 and 23.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104853","epss":0.00172,"percentile":0.06561,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104853","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104853","cwe":"CWE-73","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nx","version":"23.1.1"}},"found":{"vulnerabilityID":"GHSA-hrvq-x7jp-36xv","versionConstraint":">=23.0.0,<23.2.1 (semantic)"},"fix":{"suggestedVersion":"23.2.1"}}],"artifact":{"id":"pkg:npm/nx@23.1.1?package-id=52cc11438d048f9e","name":"nx","version":"23.1.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nx:nx:23.1.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/nx@23.1.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-6860","dataSource":"https://go.dev/cl/849365","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.0925},"relatedVulnerabilities":[{"id":"CVE-2026-78661","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.58.0"}},"found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.58.0?package-id=24feaffd25f79118","name":"golang.org/x/net","version":"v0.58.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:golang:networking:v0.58.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.58.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.58.0","upstreams":[],"metadataType":"GolangSourceMetadata","metadata":{"h1Digest":"h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=","os":"linux","architecture":"amd64","cgoEnabled":true}}},{"vulnerability":{"id":"GHSA-23wf-92cp-8pcj","dataSource":"https://github.com/advisories/GHSA-23wf-92cp-8pcj","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj","https://github.com/labstack/echo/pull/2953","https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181","https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df","https://github.com/labstack/echo/releases/tag/v4.15.2","https://github.com/labstack/echo/releases/tag/v5.1.1"],"description":"Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118658","epss":0.00186,"percentile":0.08182,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118658","cwe":"CWE-601","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.15.2"],"state":"fixed","available":[{"version":"4.15.2","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.09021000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-118658","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118658","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181","https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df","https://github.com/labstack/echo/releases/tag/v4.15.2","https://github.com/labstack/echo/releases/tag/v5.1.1","https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj"],"description":"Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118658","epss":0.00186,"percentile":0.08182,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118658","cwe":"CWE-601","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-23wf-92cp-8pcj","versionConstraint":"<4.15.2 (go)"},"fix":{"suggestedVersion":"4.15.2"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-r7w9-592q-9vg4","dataSource":"https://github.com/advisories/GHSA-r7w9-592q-9vg4","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4","https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0"],"description":"Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118266","epss":0.00163,"percentile":0.055,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118266","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.16.0"],"state":"fixed","available":[{"version":"4.16.0","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.08394499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-118266","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118266","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0","https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4"],"description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the override changes the method before CSRF evaluates it, causing both token validation and Sec-Fetch-Site checks to be skipped. A cross-site exploit requires an authenticated victim and an override value that a browser-submitted request can control, such as the form getter used by the advisory reproducer; the default X-HTTP-Method-Override header getter is not settable by a cross-site form. This issue is fixed in 4.16.0 and 5.4.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118266","epss":0.00163,"percentile":0.055,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118266","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-r7w9-592q-9vg4","versionConstraint":"<4.16.0 (go)"},"fix":{"suggestedVersion":"4.16.0"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GO-2026-6791","dataSource":"https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f","namespace":"govulndb:language:go","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-95837","https://github.com/containerd/containerd/commit/928c03c6898cad95f795300281fdff0dbc55a32f","https://github.com/containerd/containerd/pull/13913"],"description":"containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95837","epss":0.00106,"percentile":0.01101,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-95837","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.08109000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-95837","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95837","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/containerd/containerd/commit/928c03c6898cad95f795300281fdff0dbc55a32f","https://github.com/containerd/containerd/pull/13913","https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f"],"description":"containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95837","epss":0.00106,"percentile":0.01101,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-95837","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-p7v4-vr35-mj6f","dataSource":"https://github.com/advisories/GHSA-p7v4-vr35-mj6f","namespace":"github:language:go","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f","https://nvd.nist.gov/vuln/detail/CVE-2026-95837","https://github.com/containerd/containerd/pull/13913","https://github.com/containerd/containerd/commit/928c03c6898cad95f795300281fdff0dbc55a32f"],"description":"containerd CRI plugin: Checkpoint restore bypasses destination security context","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95837","epss":0.00106,"percentile":0.01101,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-95837","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GO-2026-6791","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-rg2x-37c3-w2rh","dataSource":"https://github.com/advisories/GHSA-rg2x-37c3-w2rh","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh","https://nvd.nist.gov/vuln/detail/CVE-2026-42306"],"description":"Docker: Race condition in docker cp allows bind mount redirection to host path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42306","epss":0.00104,"percentile":0.01019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42306","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42306","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07644},"relatedVulnerabilities":[{"id":"CVE-2026-42306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42306","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh"],"description":"Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42306","epss":0.00104,"percentile":0.01019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42306","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42306","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-rg2x-37c3-w2rh","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3b44c4726d0f371d","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-2ffq-g2xg-c22p","dataSource":"https://github.com/advisories/GHSA-2ffq-g2xg-c22p","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p","https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0"],"description":"Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118657","epss":0.00133,"percentile":0.0283,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118657","cwe":"CWE-346","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.16.0"],"state":"fixed","available":[{"version":"4.16.0","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.07248500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-118657","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118657","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0","https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p"],"description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118657","epss":0.00133,"percentile":0.0283,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118657","cwe":"CWE-346","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/labstack/echo/v4","version":"v4.15.1"}},"found":{"vulnerabilityID":"GHSA-2ffq-g2xg-c22p","versionConstraint":"<4.16.0 (go)"},"fix":{"suggestedVersion":"4.16.0"}}],"artifact":{"id":"pkg:golang/github.com/labstack/echo/v4@v4.15.1?package-id=9b37e1bf8afc163c","name":"github.com/labstack/echo/v4","version":"v4.15.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:labstack:echo\\/v4:v4.15.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/labstack/echo/v4@v4.15.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:S9keusg26gZpjMmPqB5hOEvNKnmd1lNmcHrbbH2lnFs="}}},{"vulnerability":{"id":"GHSA-mjcv-p78q-w5fw","dataSource":"https://github.com/advisories/GHSA-mjcv-p78q-w5fw","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw","https://github.com/moby/sys/pull/221","https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe"],"description":"github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61801","epss":0.00117,"percentile":0.01635,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61801","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.4.1"],"state":"fixed","available":[{"version":"0.4.1","date":"2026-10-08","kind":"first-observed"}]},"advisories":[],"risk":0.061425},"relatedVulnerabilities":[{"id":"CVE-2026-61801","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61801","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe","https://github.com/moby/sys/pull/221","https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw"],"description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-61801","epss":0.00117,"percentile":0.01635,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-61801","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/moby/sys/user","version":"v0.4.0"}},"found":{"vulnerabilityID":"GHSA-mjcv-p78q-w5fw","versionConstraint":"<=0.4.0 (go)"},"fix":{"suggestedVersion":"0.4.1"}}],"artifact":{"id":"pkg:golang/github.com/moby/sys/user@v0.4.0?package-id=f7aafa6bbeddca98","name":"github.com/moby/sys/user","version":"v0.4.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:moby:sys\\/user:v0.4.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/moby/sys/user@v0.4.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs="}}},{"vulnerability":{"id":"GHSA-vp62-88p7-qqf5","dataSource":"https://github.com/advisories/GHSA-vp62-88p7-qqf5","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5","https://nvd.nist.gov/vuln/detail/CVE-2026-41568"],"description":"Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H","metrics":{"baseScore":6.1,"exploitabilityScore":0.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41568","epss":0.00108,"percentile":0.0119,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41568","cwe":"CWE-81","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41568","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.05993999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41568","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41568","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5"],"description":"Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H","metrics":{"baseScore":6.1,"exploitabilityScore":0.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41568","epss":0.00108,"percentile":0.0119,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41568","cwe":"CWE-81","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41568","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-vp62-88p7-qqf5","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3b44c4726d0f371d","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-gcjh-h69q-9w9g","dataSource":"https://github.com/advisories/GHSA-gcjh-h69q-9w9g","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/cel-expr/cel-go/security/advisories/GHSA-gcjh-h69q-9w9g"],"description":"cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"fix":{"versions":["0.29.0"],"state":"fixed","available":[{"version":"0.29.0","date":"2026-07-25","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/google/cel-go","version":"v0.27.0"}},"found":{"vulnerabilityID":"GHSA-gcjh-h69q-9w9g","versionConstraint":">=0.22.0,<=0.28.1 (go)"},"fix":{"suggestedVersion":"0.29.0"}}],"artifact":{"id":"pkg:golang/github.com/google/cel-go@v0.27.0?package-id=ae17916633c94a2b","name":"github.com/google/cel-go","version":"v0.27.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:cel-go:v0.27.0:*:*:*:*:*:*:*","cpe:2.3:a:google:cel_go:v0.27.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/google/cel-go@v0.27.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:e7ih85+4qVrBuqQWTW4FKSqZYokVuc3HnhH5keboFTo="}}},{"vulnerability":{"id":"GHSA-r4xh-jqrq-34v2","dataSource":"https://github.com/advisories/GHSA-r4xh-jqrq-34v2","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-r4xh-jqrq-34v2","https://github.com/squirrelchat/smol-toml/commit/99102aa57fc932f760ea9c15b4cf1c181f952d24","https://github.com/squirrelchat/smol-toml/releases/tag/v1.9.0"],"description":"smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["1.9.0"],"state":"fixed","available":[{"version":"1.9.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"smol-toml","version":"1.6.1"}},"found":{"vulnerabilityID":"GHSA-r4xh-jqrq-34v2","versionConstraint":"<=1.8.0 (semantic)"},"fix":{"suggestedVersion":"1.9.0"}}],"artifact":{"id":"pkg:npm/smol-toml@1.6.1?package-id=31203824fd2b3719","name":"smol-toml","version":"1.6.1","type":"npm","locations":[{"path":"/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:smol-toml:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol-toml:smol_toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol_toml:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol_toml:smol_toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol:smol_toml:1.6.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/smol-toml@1.6.1","upstreams":[]}},{"vulnerability":{"id":"GO-2026-5932","dataSource":"https://go.dev/issue/44226","namespace":"govulndb:language:go","severity":"Unknown","urls":[],"description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","cvss":[],"fix":{"versions":[],"state":""},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.55.0"}},"found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.55.0?package-id=5e2b0ee5639eb777","name":"golang.org/x/crypto","version":"v0.55.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.55.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.55.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.55.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M="}}}],"source":{"type":"file","target":"safedep/vet"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:08:27.58425292Z"}}