{"grype_matches":[{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.4.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ghwc-95x2-682j","versionConstraint":">=8.9.0,<10.4.10 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-ghwc-95x2-682j","fix":{"state":"fixed","versions":["10.4.10"],"available":[{"date":"2026-06-19","kind":"first-observed","version":"10.4.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9082","cwe":"CWE-89","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2026-9082","date":"2026-10-19","epss":0.15701,"percentile":0.9683}],"risk":98.70000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-9082","https://www.drupal.org/sa-core-2026-004"],"severity":"Critical","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ghwc-95x2-682j","description":"Drupal Core has a SQL Injection issue","knownExploited":[{"cve":"CVE-2026-9082","cwes":["CWE-89"],"urls":["https://www.drupal.org/sa-core-2026-004","https://nvd.nist.gov/vuln/detail/CVE-2026-9082"],"dueDate":"2026-05-27","product":"Core","dateAdded":"2026-05-22","vendorProject":"Drupal","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-9082","cvss":[{"type":"Secondary","source":"mlhess@drupal.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9082","cwe":"CWE-89","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2026-9082","date":"2026-10-19","epss":0.15701,"percentile":0.9683}],"urls":["https://www.drupal.org/sa-core-2026-004","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9082","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.\n\nThis issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.","knownExploited":[{"cve":"CVE-2026-9082","cwes":["CWE-89"],"urls":["https://www.drupal.org/sa-core-2026-004","https://nvd.nist.gov/vuln/detail/CVE-2026-9082"],"dueDate":"2026-05-27","product":"Core","dateAdded":"2026-05-22","vendorProject":"Drupal","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mg8j-w93w-xjgc","versionConstraint":">=8.0.0,<10.2.9 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-mg8j-w93w-xjgc","fix":{"state":"fixed","versions":["10.2.9"],"available":[{"date":"2024-10-09","kind":"first-observed","version":"10.2.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45440","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45440","cwe":"CWE-209","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45440","date":"2026-10-19","epss":0.09269,"percentile":0.95324}],"risk":5.00526,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-45440","https://www.drupal.org/project/drupal/issues/3457781","https://senscybersecurity.nl/CVE-2024-45440-Explained","https://github.com/github/advisory-database/pull/4827","https://www.drupal.org/project/drupal/releases/10.3.6","https://www.drupal.org/project/drupal/releases/11.0.5","https://www.drupal.org/project/drupal/releases/10.2.9","https://www.exploit-db.com/exploits/52266"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mg8j-w93w-xjgc","description":"Drupal Full Path Disclosure"},"relatedVulnerabilities":[{"id":"CVE-2024-45440","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45440","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45440","cwe":"CWE-209","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45440","date":"2026-10-19","epss":0.09269,"percentile":0.95324}],"urls":["https://senscybersecurity.nl/CVE-2024-45440-Explained/","https://www.drupal.org/project/drupal/issues/3457781","https://www.exploit-db.com/exploits/52266"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45440","description":"core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist."}]},{"artifact":{"id":"791a42bd84378a0b","cpes":["cpe:2.3:a:drupal\\/core-recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core-recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core-recommended","purl":"pkg:composer/drupal/core-recommended@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mg8j-w93w-xjgc","versionConstraint":">=8.0.0,<10.2.9 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core-recommended","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-mg8j-w93w-xjgc","fix":{"state":"fixed","versions":["10.2.9"],"available":[{"date":"2024-10-09","kind":"first-observed","version":"10.2.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45440","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45440","cwe":"CWE-209","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45440","date":"2026-10-19","epss":0.09269,"percentile":0.95324}],"risk":5.00526,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-45440","https://www.drupal.org/project/drupal/issues/3457781","https://senscybersecurity.nl/CVE-2024-45440-Explained","https://github.com/github/advisory-database/pull/4827","https://www.drupal.org/project/drupal/releases/10.3.6","https://www.drupal.org/project/drupal/releases/11.0.5","https://www.drupal.org/project/drupal/releases/10.2.9","https://www.exploit-db.com/exploits/52266"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mg8j-w93w-xjgc","description":"Drupal Full Path Disclosure"},"relatedVulnerabilities":[{"id":"CVE-2024-45440","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-45440","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-45440","cwe":"CWE-209","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-45440","date":"2026-10-19","epss":0.09269,"percentile":0.95324}],"urls":["https://senscybersecurity.nl/CVE-2024-45440-Explained/","https://www.drupal.org/project/drupal/issues/3457781","https://www.exploit-db.com/exploits/52266"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45440","description":"core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvf2-2f4g-jqf4","versionConstraint":">=8.8.0,<10.2.11 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-gvf2-2f4g-jqf4","fix":{"state":"fixed","versions":["10.2.11"],"available":[{"date":"2024-12-11","kind":"first-observed","version":"10.2.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55638","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55638","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55638","date":"2026-10-19","epss":0.00983,"percentile":0.61706}],"risk":0.7937725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-55638","https://www.drupal.org/sa-core-2024-008"],"severity":"High","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvf2-2f4g-jqf4","description":"Drupal core contains a potential PHP Object Injection vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-55638","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55638","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55638","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55638","date":"2026-10-19","epss":0.00983,"percentile":0.61706}],"urls":["https://www.drupal.org/sa-core-2024-008"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-55638","description":"Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.\n\nDrupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability."}]},{"artifact":{"id":"791a42bd84378a0b","cpes":["cpe:2.3:a:drupal\\/core-recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core-recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core-recommended","purl":"pkg:composer/drupal/core-recommended@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gvf2-2f4g-jqf4","versionConstraint":">=8.8.0,<10.2.11 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core-recommended","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-gvf2-2f4g-jqf4","fix":{"state":"fixed","versions":["10.2.11"],"available":[{"date":"2024-12-11","kind":"first-observed","version":"10.2.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55638","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55638","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55638","date":"2026-10-19","epss":0.00983,"percentile":0.61706}],"risk":0.7937725,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-55638","https://www.drupal.org/sa-core-2024-008"],"severity":"High","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvf2-2f4g-jqf4","description":"Drupal core contains a potential PHP Object Injection vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-55638","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55638","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55638","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55638","date":"2026-10-19","epss":0.00983,"percentile":0.61706}],"urls":["https://www.drupal.org/sa-core-2024-008"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-55638","description":"Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.\n\nDrupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w6rx-9g2x-mg5g","versionConstraint":">=8.8.0,<10.2.11 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-w6rx-9g2x-mg5g","fix":{"state":"fixed","versions":["10.2.11"],"available":[{"date":"2024-12-11","kind":"first-observed","version":"10.2.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55637","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55637","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55637","date":"2026-10-19","epss":0.00826,"percentile":0.56717}],"risk":0.666995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-55637","https://www.drupal.org/sa-core-2024-007","https://github.com/drupal/core/commit/1664030d399c73b4144f410f2ccc68c66a947f8d"],"severity":"High","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w6rx-9g2x-mg5g","description":"Drupal core contains a potential PHP Object Injection vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-55637","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55637","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55637","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55637","date":"2026-10-19","epss":0.00826,"percentile":0.56717}],"urls":["https://www.drupal.org/sa-core-2024-007"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-55637","description":"Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.\n\nDrupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability."}]},{"artifact":{"id":"791a42bd84378a0b","cpes":["cpe:2.3:a:drupal\\/core-recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core-recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core-recommended","purl":"pkg:composer/drupal/core-recommended@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w6rx-9g2x-mg5g","versionConstraint":">=8.8.0,<10.2.11 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core-recommended","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-w6rx-9g2x-mg5g","fix":{"state":"fixed","versions":["10.2.11"],"available":[{"date":"2024-12-11","kind":"first-observed","version":"10.2.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55637","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55637","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55637","date":"2026-10-19","epss":0.00826,"percentile":0.56717}],"risk":0.666995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-55637","https://www.drupal.org/sa-core-2024-007","https://github.com/drupal/core/commit/1664030d399c73b4144f410f2ccc68c66a947f8d"],"severity":"High","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w6rx-9g2x-mg5g","description":"Drupal core contains a potential PHP Object Injection vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-55637","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55637","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55637","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55637","date":"2026-10-19","epss":0.00826,"percentile":0.56717}],"urls":["https://www.drupal.org/sa-core-2024-007"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-55637","description":"Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.\n\nDrupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-938f-5r4f-h65v","versionConstraint":">=8.8.0,<10.2.11 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-938f-5r4f-h65v","fix":{"state":"fixed","versions":["10.2.11"],"available":[{"date":"2024-12-11","kind":"first-observed","version":"10.2.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55636","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55636","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55636","date":"2026-10-19","epss":0.0093,"percentile":0.59968}],"risk":0.420825,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-55636","https://www.drupal.org/sa-core-2024-006","https://github.com/drupal/core/commit/17f362b988e6ad6bd5cc1e7e8a7a0804e1536fbc"],"severity":"Low","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-938f-5r4f-h65v","description":"Drupal core contains a potential PHP Object Injection vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-55636","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55636","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55636","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55636","date":"2026-10-19","epss":0.0093,"percentile":0.59968}],"urls":["https://www.drupal.org/sa-core-2024-006"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-55636","description":"Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.\n\nDrupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so called gadget chain presents no direct threat, but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability."}]},{"artifact":{"id":"791a42bd84378a0b","cpes":["cpe:2.3:a:drupal\\/core-recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core-recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core-recommended","purl":"pkg:composer/drupal/core-recommended@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-938f-5r4f-h65v","versionConstraint":">=8.8.0,<10.2.11 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core-recommended","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-938f-5r4f-h65v","fix":{"state":"fixed","versions":["10.2.11"],"available":[{"date":"2024-12-11","kind":"first-observed","version":"10.2.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55636","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55636","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55636","date":"2026-10-19","epss":0.0093,"percentile":0.59968}],"risk":0.420825,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-55636","https://www.drupal.org/sa-core-2024-006","https://github.com/drupal/core/commit/17f362b988e6ad6bd5cc1e7e8a7a0804e1536fbc"],"severity":"Low","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-938f-5r4f-h65v","description":"Drupal core contains a potential PHP Object Injection vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-55636","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55636","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55636","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55636","date":"2026-10-19","epss":0.0093,"percentile":0.59968}],"urls":["https://www.drupal.org/sa-core-2024-006"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-55636","description":"Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.\n\nDrupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so called gadget chain presents no direct threat, but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.3.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2qph-q8xw-gv7q","versionConstraint":">=8.0.0,<10.3.13 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-2qph-q8xw-gv7q","fix":{"state":"fixed","versions":["10.3.13"],"available":[{"date":"2025-04-02","kind":"first-observed","version":"10.3.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":4.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31674","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2025-31674","cwe":"CWE-913","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31674","date":"2026-10-19","epss":0.00584,"percentile":0.46874}],"risk":0.2774,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-31674","https://www.drupal.org/sa-core-2025-003"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2qph-q8xw-gv7q","description":"Drupal Core Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-31674","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31674","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2025-31674","cwe":"CWE-913","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31674","date":"2026-10-19","epss":0.00584,"percentile":0.46874}],"urls":["https://www.drupal.org/sa-core-2025-003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-31674","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7cwc-fjqm-8vh8","versionConstraint":">=8.0.0,<10.2.11 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-7cwc-fjqm-8vh8","fix":{"state":"fixed","versions":["10.2.11"],"available":[{"date":"2024-12-11","kind":"first-observed","version":"10.2.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55634","cwe":"CWE-178","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55634","cwe":"CWE-289","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55634","cwe":"CWE-178","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55634","date":"2026-10-19","epss":0.00414,"percentile":0.34323}],"risk":0.24632999999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-55634","https://www.drupal.org/sa-core-2024-004","https://github.com/drupal/core/commit/7ae0e8f1824e15f8b2b06e4da09836250e85e934"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7cwc-fjqm-8vh8","description":"Drupal core Access bypass"},"relatedVulnerabilities":[{"id":"CVE-2024-55634","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55634","cwe":"CWE-178","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55634","cwe":"CWE-289","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55634","cwe":"CWE-178","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55634","date":"2026-10-19","epss":0.00414,"percentile":0.34323}],"urls":["https://www.drupal.org/sa-core-2024-004"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-55634","description":"A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8."}]},{"artifact":{"id":"791a42bd84378a0b","cpes":["cpe:2.3:a:drupal\\/core-recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core-recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core-recommended","purl":"pkg:composer/drupal/core-recommended@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7cwc-fjqm-8vh8","versionConstraint":">=8.0.0,<10.2.11 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core-recommended","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-7cwc-fjqm-8vh8","fix":{"state":"fixed","versions":["10.2.11"],"available":[{"date":"2024-12-11","kind":"first-observed","version":"10.2.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55634","cwe":"CWE-178","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55634","cwe":"CWE-289","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55634","cwe":"CWE-178","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55634","date":"2026-10-19","epss":0.00414,"percentile":0.34323}],"risk":0.24632999999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-55634","https://www.drupal.org/sa-core-2024-004","https://github.com/drupal/core/commit/7ae0e8f1824e15f8b2b06e4da09836250e85e934"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7cwc-fjqm-8vh8","description":"Drupal core Access bypass"},"relatedVulnerabilities":[{"id":"CVE-2024-55634","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-55634","cwe":"CWE-178","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55634","cwe":"CWE-289","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-55634","cwe":"CWE-178","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-55634","date":"2026-10-19","epss":0.00414,"percentile":0.34323}],"urls":["https://www.drupal.org/sa-core-2024-004"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-55634","description":"A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xmjc-63pr-2mpg","versionConstraint":">=8.0.0,<10.5.9 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-xmjc-63pr-2mpg","fix":{"state":"fixed","versions":["10.5.9"],"available":[{"date":"2026-06-06","kind":"first-observed","version":"10.5.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6366","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2026-6366","date":"2026-10-19","epss":0.00417,"percentile":0.34603}],"risk":0.24186,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-6366","https://www.drupal.org/sa-core-2026-002"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xmjc-63pr-2mpg","description":"Drupal core allows Object Injection"},"relatedVulnerabilities":[{"id":"CVE-2026-6366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6366","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2026-6366","date":"2026-10-19","epss":0.00417,"percentile":0.34603}],"urls":["https://www.drupal.org/sa-core-2026-002"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6366","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.\n\nThis issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7."}]},{"artifact":{"id":"fd7c22299c4ded1e","cpes":["cpe:2.3:a:gnu:tar:1.35-r4:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r4:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r4?arch=x86_64&distro=alpine-3.23.6","type":"apk","version":"1.35-r4","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:5d963f7ebb64307ee422811cb4e24c10440187bb0535b3c22442fb8a72cce463","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-5704","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r4"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-5704","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-10-19","epss":0.00401,"percentile":0.32902}],"risk":0.20551249999999996,"urls":["https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:66514","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-5704","https://bugzilla.redhat.com/show_bug.cgi?id=2455360","http://www.openwall.com/lists/oss-security/2026/04/11/10","http://www.openwall.com/lists/oss-security/2026/04/11/11","http://www.openwall.com/lists/oss-security/2026/04/12/2"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."},"relatedVulnerabilities":[]},{"artifact":{"id":"5b8a9495e4efe754","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r30:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r30?arch=x86_64&distro=alpine-3.23.6","type":"apk","version":"1.37.0-r30","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:5d963f7ebb64307ee422811cb4e24c10440187bb0535b3c22442fb8a72cce463","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r30"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-19","epss":0.00312,"percentile":0.22643}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"3e88c98a595f91bf","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r30:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r30?arch=x86_64&distro=alpine-3.23.6&upstream=busybox","type":"apk","version":"1.37.0-r30","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:5d963f7ebb64307ee422811cb4e24c10440187bb0535b3c22442fb8a72cce463","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r30"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-19","epss":0.00312,"percentile":0.22643}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"70e62fc46b7f6a24","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r30:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r30:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r30?arch=x86_64&distro=alpine-3.23.6&upstream=busybox","type":"apk","version":"1.37.0-r30","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:5d963f7ebb64307ee422811cb4e24c10440187bb0535b3c22442fb8a72cce463","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r30"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-19","epss":0.00312,"percentile":0.22643}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8mvq-8h2v-j9vf","versionConstraint":">=8.8.0,<10.2.11 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-8mvq-8h2v-j9vf","fix":{"state":"fixed","versions":["10.2.11"],"available":[{"date":"2024-12-11","kind":"first-observed","version":"10.2.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12393","cwe":"CWE-79","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-12393","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-12393","date":"2026-10-19","epss":0.00336,"percentile":0.25557}],"risk":0.17388,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-12393","https://www.drupal.org/sa-core-2024-003","https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8mvq-8h2v-j9vf","description":"Drupal Core Cross-Site Scripting (XSS)"},"relatedVulnerabilities":[{"id":"CVE-2024-12393","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12393","cwe":"CWE-79","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-12393","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-12393","date":"2026-10-19","epss":0.00336,"percentile":0.25557}],"urls":["https://www.drupal.org/sa-core-2024-003"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12393","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8."}]},{"artifact":{"id":"791a42bd84378a0b","cpes":["cpe:2.3:a:drupal\\/core-recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core-recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core_recommended:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core-recommended:9.8.0:*:*:*:*:*:*:*","cpe:2.3:a:drupal\\/core:drupal\\/core_recommended:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core-recommended","purl":"pkg:composer/drupal/core-recommended@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.2.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8mvq-8h2v-j9vf","versionConstraint":">=8.8.0,<10.2.11 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core-recommended","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-8mvq-8h2v-j9vf","fix":{"state":"fixed","versions":["10.2.11"],"available":[{"date":"2024-12-11","kind":"first-observed","version":"10.2.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12393","cwe":"CWE-79","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-12393","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-12393","date":"2026-10-19","epss":0.00336,"percentile":0.25557}],"risk":0.17388,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-12393","https://www.drupal.org/sa-core-2024-003","https://github.com/drupal/core/commit/276ac67ad891605052e0a24fb36ece9caaa511e8"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8mvq-8h2v-j9vf","description":"Drupal Core Cross-Site Scripting (XSS)"},"relatedVulnerabilities":[{"id":"CVE-2024-12393","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-12393","cwe":"CWE-79","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2024-12393","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-12393","date":"2026-10-19","epss":0.00336,"percentile":0.25557}],"urls":["https://www.drupal.org/sa-core-2024-003"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-12393","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.3.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-39g6-x4x8-5jcm","versionConstraint":">=8.0.0,<10.3.13 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-39g6-x4x8-5jcm","fix":{"state":"fixed","versions":["10.3.13"],"available":[{"date":"2025-04-03","kind":"first-observed","version":"10.3.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3057","cwe":"CWE-79","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2025-3057","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-3057","date":"2026-10-19","epss":0.00304,"percentile":0.21812}],"risk":0.16871999999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-3057","https://www.drupal.org/sa-core-2025-001"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-39g6-x4x8-5jcm","description":"Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages"},"relatedVulnerabilities":[{"id":"CVE-2025-3057","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3057","cwe":"CWE-79","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2025-3057","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-3057","date":"2026-10-19","epss":0.00304,"percentile":0.21812}],"urls":["https://www.drupal.org/sa-core-2025-001"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-3057","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.5.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f3cj-mjqm-fhvj","versionConstraint":">=8.0.0,<10.5.9 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-f3cj-mjqm-fhvj","fix":{"state":"fixed","versions":["10.5.9"],"available":[{"date":"2026-06-06","kind":"first-observed","version":"10.5.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6365","cwe":"CWE-79","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2026-6365","date":"2026-10-19","epss":0.00299,"percentile":0.21271}],"risk":0.16594499999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-6365","https://www.drupal.org/sa-core-2026-001"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f3cj-mjqm-fhvj","description":"Drupal core is Vulnerable to Cross-Site Scripting"},"relatedVulnerabilities":[{"id":"CVE-2026-6365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6365","cwe":"CWE-79","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2026-6365","date":"2026-10-19","epss":0.00299,"percentile":0.21271}],"urls":["https://www.drupal.org/sa-core-2026-001"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6365","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).\n\nThis issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.3.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m4wj-hhwj-47qp","versionConstraint":">=8.0.0,<10.3.14 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-m4wj-hhwj-47qp","fix":{"state":"fixed","versions":["10.3.14"],"available":[{"date":"2025-04-02","kind":"first-observed","version":"10.3.14"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U","metrics":{"baseScore":1.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31675","cwe":"CWE-79","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2025-31675","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31675","date":"2026-10-19","epss":0.00492,"percentile":0.40972}],"risk":0.15621000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-31675","https://www.drupal.org/sa-core-2025-004","https://d7es.tag1.com/security-advisories/link-moderately-critical-cross-site-scripting-sa-core-2025-004","https://www.herodevs.com/vulnerability-directory/cve-2025-31675"],"severity":"Low","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m4wj-hhwj-47qp","description":"Drupal Core Cross-Site Scripting (XSS) Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2025-31675","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31675","cwe":"CWE-79","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2025-31675","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31675","date":"2026-10-19","epss":0.00492,"percentile":0.40972}],"urls":["https://d7es.tag1.com/security-advisories/link-moderately-critical-cross-site-scripting-sa-core-2025-004","https://www.drupal.org/sa-core-2025-004","https://www.herodevs.com/vulnerability-directory/cve-2025-31675"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-31675","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.3.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wpp8-fjgf-pwc7","versionConstraint":">=8.0.0,<10.3.13 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-wpp8-fjgf-pwc7","fix":{"state":"fixed","versions":["10.3.13"],"available":[{"date":"2025-04-02","kind":"first-observed","version":"10.3.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31673","cwe":"CWE-863","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2025-31673","cwe":"CWE-863","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31673","date":"2026-10-19","epss":0.00311,"percentile":0.22492}],"risk":0.15472249999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-31673","https://www.drupal.org/sa-core-2025-002"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wpp8-fjgf-pwc7","description":"Drupal Core Vulnerable to Forceful Browsing"},"relatedVulnerabilities":[{"id":"CVE-2025-31673","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31673","cwe":"CWE-863","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2025-31673","cwe":"CWE-863","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-31673","date":"2026-10-19","epss":0.00311,"percentile":0.22492}],"urls":["https://www.drupal.org/sa-core-2025-002"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-31673","description":"Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.4.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m6vv-vcj8-w8m7","versionConstraint":">=8.0.0,<10.4.9 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-m6vv-vcj8-w8m7","fix":{"state":"fixed","versions":["10.4.9"],"available":[{"date":"2025-11-19","kind":"first-observed","version":"10.4.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":4.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13081","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2025-13081","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13081","date":"2026-10-19","epss":0.0028,"percentile":0.19216}],"risk":0.1428,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-13081","https://www.drupal.org/sa-core-2025-006"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m6vv-vcj8-w8m7","description":"Drupal core allows Object Injection"},"relatedVulnerabilities":[{"id":"CVE-2025-13081","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13081","cwe":"CWE-915","type":"Secondary","source":"mlhess@drupal.org"},{"cve":"CVE-2025-13081","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13081","date":"2026-10-19","epss":0.0028,"percentile":0.19216}],"urls":["https://www.drupal.org/sa-core-2025-006"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13081","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8."}]},{"artifact":{"id":"8d6f32361002c027","cpes":["cpe:2.3:a:nghttp2-libs:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2_libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp-libs:1.69.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp_libs:1.69.0-r0:*:*:*:*:*:*:*"],"name":"nghttp2-libs","purl":"pkg:apk/alpine/nghttp2-libs@1.69.0-r0?arch=x86_64&distro=alpine-3.23.6&upstream=nghttp2","type":"apk","version":"1.69.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libnghttp2.so.14"},{"path":"/usr/lib/libnghttp2.so.14.29.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:5d963f7ebb64307ee422811cb4e24c10440187bb0535b3c22442fb8a72cce463","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nghttp2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-58055","versionConstraint":"<= 1.69.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:1.69.0:*:*:*:*:*:*:*"],"package":{"name":"nghttp2","version":"1.69.0-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-58055","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58055","cwe":"CWE-444","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58055","date":"2026-10-19","epss":0.00253,"percentile":0.15792}],"risk":0.1372525,"urls":["https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc","https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e1e","https://www.vulncheck.com/advisories/nghttp2-nghttpx-http-request-response-smuggling-via-upgrade-request-with-content-length"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58055","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning."},"relatedVulnerabilities":[]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.4.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-83v7-c2cf-p9c2","versionConstraint":">=8.0.0,<10.4.9 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-83v7-c2cf-p9c2","fix":{"state":"fixed","versions":["10.4.9"],"available":[{"date":"2025-11-19","kind":"first-observed","version":"10.4.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13080","cwe":"CWE-754","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2025-13080","date":"2026-10-19","epss":0.00347,"percentile":0.26785}],"risk":0.09889500000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-13080","https://www.drupal.org/sa-core-2025-005"],"severity":"Low","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-83v7-c2cf-p9c2","description":"Drupal core allows Forceful Browsing"},"relatedVulnerabilities":[{"id":"CVE-2025-13080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13080","cwe":"CWE-754","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2025-13080","date":"2026-10-19","epss":0.00347,"percentile":0.26785}],"urls":["https://www.drupal.org/sa-core-2025-005"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13080","description":"Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8."}]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.4.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mhpg-hpj5-73r2","versionConstraint":">=8.0.0,<10.4.9 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-mhpg-hpj5-73r2","fix":{"state":"fixed","versions":["10.4.9"],"available":[{"date":"2025-11-19","kind":"first-observed","version":"10.4.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":1.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13083","cwe":"CWE-525","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2025-13083","date":"2026-10-19","epss":0.00278,"percentile":0.19048}],"risk":0.07923,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-13083","https://www.drupal.org/sa-core-2025-008"],"severity":"Low","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mhpg-hpj5-73r2","description":"Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels"},"relatedVulnerabilities":[{"id":"CVE-2025-13083","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13083","cwe":"CWE-525","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2025-13083","date":"2026-10-19","epss":0.00278,"percentile":0.19048}],"urls":["https://www.drupal.org/sa-core-2025-008"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13083","description":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103."}]},{"artifact":{"id":"fd7c22299c4ded1e","cpes":["cpe:2.3:a:gnu:tar:1.35-r4:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r4:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r4?arch=x86_64&distro=alpine-3.23.6","type":"apk","version":"1.35-r4","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:5d963f7ebb64307ee422811cb4e24c10440187bb0535b3c22442fb8a72cce463","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-18508","versionConstraint":"= 1.35 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r4"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-18508","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-10-19","epss":0.00141,"percentile":0.03068}],"risk":0.06627,"urls":["https://access.redhat.com/errata/RHSA-2026:50807","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18508","https://bugzilla.redhat.com/show_bug.cgi?id=2509843"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction."},"relatedVulnerabilities":[]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.4.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h89p-5896-f4q8","versionConstraint":">=8.0.0,<10.4.9 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-h89p-5896-f4q8","fix":{"state":"fixed","versions":["10.4.9"],"available":[{"date":"2025-11-19","kind":"first-observed","version":"10.4.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13082","cwe":"CWE-451","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2025-13082","date":"2026-10-19","epss":0.00243,"percentile":0.14542}],"risk":0.061965,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-13082","https://www.drupal.org/sa-core-2025-007"],"severity":"Low","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h89p-5896-f4q8","description":"Drupal core allows Content Spoofing"},"relatedVulnerabilities":[{"id":"CVE-2025-13082","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13082","cwe":"CWE-451","type":"Secondary","source":"mlhess@drupal.org"}],"epss":[{"cve":"CVE-2025-13082","date":"2026-10-19","epss":0.00243,"percentile":0.14542}],"urls":["https://www.drupal.org/sa-core-2025-007"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13082","description":"User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8."}]},{"artifact":{"id":"fd7c22299c4ded1e","cpes":["cpe:2.3:a:gnu:tar:1.35-r4:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar:1.35-r4:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:apk/alpine/tar@1.35-r4?arch=x86_64&distro=alpine-3.23.6","type":"apk","version":"1.35-r4","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/tar"},{"path":"/usr"},{"path":"/usr/libexec"},{"path":"/usr/libexec/rmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:5d963f7ebb64307ee422811cb4e24c10440187bb0535b3c22442fb8a72cce463","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"tar"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-18477","versionConstraint":"= 1.35 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:tar:1.35:*:*:*:*:*:*:*"],"package":{"name":"tar","version":"1.35-r4"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-18477","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-10-19","epss":0.0008,"percentile":0.00148}],"risk":0.0376,"urls":["https://access.redhat.com/errata/RHSA-2026:49361","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18477","https://bugzilla.redhat.com/show_bug.cgi?id=2509735"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"1dc70fef9bbf4ad7","cpes":["cpe:2.3:a:drupal\\/core:drupal\\/core:9.8.0:*:*:*:*:*:*:*"],"name":"drupal/core","purl":"pkg:composer/drupal/core@9.8.0","type":"php-composer","version":"9.8.0","language":"php","licenses":[],"locations":[{"path":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","layerID":"sha256:abf5bf2217590563a3a0df1c61921e9664ac604e37cae57458e9f1c720aa77ea","accessPath":"/opt/drupal/web/core/modules/package_manager/tests/fixtures/fake_site/vendor/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"10.1.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6ccv-8fgf-cjpw","versionConstraint":">=8.0.0,<10.1.8 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"drupal/core","version":"9.8.0"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-6ccv-8fgf-cjpw","fix":{"state":"fixed","versions":["10.1.8"],"available":[{"date":"2024-02-13","kind":"first-observed","version":"10.1.8"}]},"cvss":[],"risk":0,"urls":["https://github.com/drupal/core/commit/2f76ac716ca8019bc60579fdfc8aa6cd65d57dff","https://github.com/drupal/core/commit/5e606b560ac4ecb08135f12b6165bbe0348346a0","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2024-01-17.yaml","https://www.drupal.org/sa-core-2024-001"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6ccv-8fgf-cjpw","description":"Drupal core Denial of Service vulnerability"},"relatedVulnerabilities":[]}],"grade":"F","score":"11.00","as_of":"2026-10-20T13:34:11.816Z","grype_db_version":"2026-10-20T06:29:49.000Z"}