{"grype_matches":[{"artifact":{"id":"93a0da5a6bb82d14","cpes":["cpe:2.3:a:libxslt:libxslt:1.1.43-r3:*:*:*:*:*:*:*"],"name":"libxslt","purl":"pkg:apk/alpine/libxslt@1.1.43-r3?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.1.43-r3","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/xsltproc"},{"path":"/usr/lib"},{"path":"/usr/lib/libexslt.so.0"},{"path":"/usr/lib/libexslt.so.0.8.24"},{"path":"/usr/lib/libxslt.so.1"},{"path":"/usr/lib/libxslt.so.1.1.43"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxslt"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-125350","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125350","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-125350","fix":{"state":"fixed","versions":["1.1.43-r4"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.1.43-r4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"risk":85.57500000000002,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-125350","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-125350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/582442907","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"9d1d39edabfadba9","cpes":["cpe:2.3:a:microsoft_corporation:system_text_json_.net:6.0.9:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_text_json:6.0.9:*:*:*:*:*:*:*","cpe:2.3:a:system_text_json:system_text_json_.net:6.0.9:*:*:*:*:*:*:*","cpe:2.3:a:system_text_json:system_text_json:6.0.9:*:*:*:*:*:*:*"],"name":"System.Text.Json","purl":"pkg:nuget/System.Text.Json@6.0.9","type":"dotnet","version":"6.0.9","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.RuntimePatches.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.RuntimePatches.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Text.Json.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Text.Json.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.0.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8g4q-xg66-9fp4","versionConstraint":">=6.0.0,<=6.0.9 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Text.Json","version":"6.0.9"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-8g4q-xg66-9fp4","fix":{"state":"fixed","versions":["6.0.10"],"available":[{"date":"2024-10-09","kind":"first-observed","version":"6.0.10"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43485","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-43485","date":"2026-11-12","epss":0.03078,"percentile":0.87855}],"risk":2.4085349999999996,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-8g4q-xg66-9fp4","https://nvd.nist.gov/vuln/detail/CVE-2024-43485","https://github.com/dotnet/announcements/issues/329","https://github.com/dotnet/runtime/issues/108678","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8g4q-xg66-9fp4","description":"Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-43485","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-43485","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-43485","date":"2026-11-12","epss":0.03078,"percentile":0.87855}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43485","description":".NET and Visual Studio Denial of Service Vulnerability"}]},{"artifact":{"id":"add61770944991c4","cpes":["cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"Microsoft.IdentityModel.JsonWebTokens","purl":"pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.SignalR.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"Microsoft.IdentityModel.JsonWebTokens","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"0ea2d718e4f63a1d","cpes":["cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"Microsoft.IdentityModel.JsonWebTokens","purl":"pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Host.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"Microsoft.IdentityModel.JsonWebTokens","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"1b9c38dbd3cce15e","cpes":["cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"Microsoft.IdentityModel.JsonWebTokens","purl":"pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Http.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"Microsoft.IdentityModel.JsonWebTokens","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"7bbb0ef184b20dd9","cpes":["cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"Microsoft.IdentityModel.JsonWebTokens","purl":"pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Core.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"Microsoft.IdentityModel.JsonWebTokens","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"ddafb2cd03363583","cpes":["cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"Microsoft.IdentityModel.JsonWebTokens","purl":"pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"Microsoft.IdentityModel.JsonWebTokens","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"d58dabfa3a18a446","cpes":["cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_identitymodel_jsonwebtokens:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_jsonwebtokens:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"Microsoft.IdentityModel.JsonWebTokens","purl":"pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Microsoft.IdentityModel.JsonWebTokens.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"Microsoft.IdentityModel.JsonWebTokens","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"f210910681e9f405","cpes":["cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"System.IdentityModel.Tokens.Jwt","purl":"pkg:nuget/System.IdentityModel.Tokens.Jwt@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.IdentityModel.Tokens.Jwt","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"4f26250cd36a0a8b","cpes":["cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"System.IdentityModel.Tokens.Jwt","purl":"pkg:nuget/System.IdentityModel.Tokens.Jwt@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.IdentityModel.Tokens.Jwt","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"8f979232c7ab2243","cpes":["cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"System.IdentityModel.Tokens.Jwt","purl":"pkg:nuget/System.IdentityModel.Tokens.Jwt@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Core.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.IdentityModel.Tokens.Jwt","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"e569b79a4d7fe3e3","cpes":["cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"System.IdentityModel.Tokens.Jwt","purl":"pkg:nuget/System.IdentityModel.Tokens.Jwt@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Host.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.IdentityModel.Tokens.Jwt","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"4c763f4123ae74aa","cpes":["cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"System.IdentityModel.Tokens.Jwt","purl":"pkg:nuget/System.IdentityModel.Tokens.Jwt@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Http.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.IdentityModel.Tokens.Jwt","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"eb967354adb0d546","cpes":["cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:system_identitymodel_tokens_jwt:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:system_identitymodel_tokens_jwt:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel_.net:6.8.0:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation_:microsoft_identitymodel:6.8.0:*:*:*:*:*:*:*"],"name":"System.IdentityModel.Tokens.Jwt","purl":"pkg:nuget/System.IdentityModel.Tokens.Jwt@6.8.0","type":"dotnet","version":"6.8.0","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.SignalR.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.IdentityModel.Tokens.Jwt.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.34.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-59j7-ghrg-fj52","versionConstraint":">=6.5.0,<6.34.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.IdentityModel.Tokens.Jwt","version":"6.8.0"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-59j7-ghrg-fj52","fix":{"state":"fixed","versions":["6.34.0"],"available":[{"date":"2024-01-10","kind":"first-observed","version":"6.34.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"risk":1.70628,"urls":["https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2","https://github.com/dotnet/aspnetcore/security/advisories/GHSA-59j7-ghrg-fj52","https://github.com/dotnet/announcements/issues/290"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-59j7-ghrg-fj52","description":"Microsoft ASP.NET Core project templates vulnerable to denial of service"},"relatedVulnerabilities":[{"id":"CVE-2024-21319","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-21319","cwe":"CWE-20","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2024-21319","date":"2026-11-12","epss":0.02892,"percentile":0.87103}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319","description":"Microsoft Identity Denial of service vulnerability"}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119586","versionConstraint":"<= 3.54.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119586","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-12","epss":0.01545,"percentile":0.75347}],"risk":1.2089625,"urls":["https://abraxaslabs.tech/research/sqlite-cli-recover","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586","description":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."},"relatedVulnerabilities":[]},{"artifact":{"id":"731faa3b80a09be5","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Http.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-846f-f764-76mx","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-846f-f764-76mx","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"risk":0.74325,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx","https://github.com/dotnet/announcements/issues/468","https://github.com/dotnet/runtime/issues/135703","https://nvd.nist.gov/vuln/detail/CVE-2026-84008","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-846f-f764-76mx","description":"Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-84008","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."}]},{"artifact":{"id":"9cce8b0231e751e2","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Core.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-846f-f764-76mx","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-846f-f764-76mx","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"risk":0.74325,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx","https://github.com/dotnet/announcements/issues/468","https://github.com/dotnet/runtime/issues/135703","https://nvd.nist.gov/vuln/detail/CVE-2026-84008","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-846f-f764-76mx","description":"Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-84008","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."}]},{"artifact":{"id":"d4ae2a9f07cfbf46","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-846f-f764-76mx","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-846f-f764-76mx","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"risk":0.74325,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx","https://github.com/dotnet/announcements/issues/468","https://github.com/dotnet/runtime/issues/135703","https://nvd.nist.gov/vuln/detail/CVE-2026-84008","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-846f-f764-76mx","description":"Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-84008","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."}]},{"artifact":{"id":"c491f3bcc4e97973","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.SignalR.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-846f-f764-76mx","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-846f-f764-76mx","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"risk":0.74325,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx","https://github.com/dotnet/announcements/issues/468","https://github.com/dotnet/runtime/issues/135703","https://nvd.nist.gov/vuln/detail/CVE-2026-84008","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-846f-f764-76mx","description":"Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-84008","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."}]},{"artifact":{"id":"4aeeb02384ef3e21","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Host.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-846f-f764-76mx","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-846f-f764-76mx","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"risk":0.74325,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx","https://github.com/dotnet/announcements/issues/468","https://github.com/dotnet/runtime/issues/135703","https://nvd.nist.gov/vuln/detail/CVE-2026-84008","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-846f-f764-76mx","description":"Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-84008","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."}]},{"artifact":{"id":"924946f27e8ff95b","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-846f-f764-76mx","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-846f-f764-76mx","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"risk":0.74325,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-846f-f764-76mx","https://github.com/dotnet/announcements/issues/468","https://github.com/dotnet/runtime/issues/135703","https://nvd.nist.gov/vuln/detail/CVE-2026-84008","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-846f-f764-76mx","description":"Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-84008","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84008","cwe":"CWE-407","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-84008","date":"2026-11-12","epss":0.00991,"percentile":0.63009}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84008","description":"Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.68625,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.6749999999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.58425,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.5482499999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"731faa3b80a09be5","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Http.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fmv-rv2c-59x7","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-2fmv-rv2c-59x7","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"risk":0.487775,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7","https://github.com/dotnet/announcements/issues/454","https://github.com/dotnet/runtime/issues/135699","https://nvd.nist.gov/vuln/detail/CVE-2026-70162","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fmv-rv2c-59x7","description":"Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-70162","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70162","description":"A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.\nThe update addresses the vulnerability by correcting how the .NET web application handles web requests."}]},{"artifact":{"id":"4aeeb02384ef3e21","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Host.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fmv-rv2c-59x7","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-2fmv-rv2c-59x7","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"risk":0.487775,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7","https://github.com/dotnet/announcements/issues/454","https://github.com/dotnet/runtime/issues/135699","https://nvd.nist.gov/vuln/detail/CVE-2026-70162","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fmv-rv2c-59x7","description":"Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-70162","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70162","description":"A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.\nThe update addresses the vulnerability by correcting how the .NET web application handles web requests."}]},{"artifact":{"id":"c491f3bcc4e97973","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.SignalR.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fmv-rv2c-59x7","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-2fmv-rv2c-59x7","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"risk":0.487775,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7","https://github.com/dotnet/announcements/issues/454","https://github.com/dotnet/runtime/issues/135699","https://nvd.nist.gov/vuln/detail/CVE-2026-70162","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fmv-rv2c-59x7","description":"Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-70162","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70162","description":"A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.\nThe update addresses the vulnerability by correcting how the .NET web application handles web requests."}]},{"artifact":{"id":"9cce8b0231e751e2","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Core.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fmv-rv2c-59x7","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-2fmv-rv2c-59x7","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"risk":0.487775,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7","https://github.com/dotnet/announcements/issues/454","https://github.com/dotnet/runtime/issues/135699","https://nvd.nist.gov/vuln/detail/CVE-2026-70162","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fmv-rv2c-59x7","description":"Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-70162","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70162","description":"A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.\nThe update addresses the vulnerability by correcting how the .NET web application handles web requests."}]},{"artifact":{"id":"d4ae2a9f07cfbf46","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fmv-rv2c-59x7","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-2fmv-rv2c-59x7","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"risk":0.487775,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7","https://github.com/dotnet/announcements/issues/454","https://github.com/dotnet/runtime/issues/135699","https://nvd.nist.gov/vuln/detail/CVE-2026-70162","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fmv-rv2c-59x7","description":"Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-70162","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70162","description":"A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.\nThe update addresses the vulnerability by correcting how the .NET web application handles web requests."}]},{"artifact":{"id":"924946f27e8ff95b","cpes":["cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:system_security_cryptography_pkcs:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs_.net:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:microsoft_corporation:system_security_cryptography_pkcs:8.0.1:*:*:*:*:*:*:*"],"name":"System.Security.Cryptography.Pkcs","purl":"pkg:nuget/System.Security.Cryptography.Pkcs@8.0.1","type":"dotnet","version":"8.0.1","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/System.Security.Cryptography.Pkcs.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2fmv-rv2c-59x7","versionConstraint":">=8.0.0,<=8.0.1 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"System.Security.Cryptography.Pkcs","version":"8.0.1"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-2fmv-rv2c-59x7","fix":{"state":"fixed","versions":["8.0.2"],"available":[{"date":"2026-10-14","kind":"first-observed","version":"8.0.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"risk":0.487775,"urls":["https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7","https://github.com/dotnet/announcements/issues/454","https://github.com/dotnet/runtime/issues/135699","https://nvd.nist.gov/vuln/detail/CVE-2026-70162","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2fmv-rv2c-59x7","description":"Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2026-70162","cvss":[{"type":"Secondary","source":"secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70162","cwe":"CWE-405","type":"Secondary","source":"secure@microsoft.com"}],"epss":[{"cve":"CVE-2026-70162","date":"2026-11-12","epss":0.00895,"percentile":0.59992}],"urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70162","description":"A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.\nA remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.\nThe update addresses the vulnerability by correcting how the .NET web application handles web requests."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40355","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-40355","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40355","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40355","date":"2026-11-12","epss":0.00645,"percentile":0.51443}],"risk":0.48374999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-40355"},"relatedVulnerabilities":[{"id":"CVE-2026-40355","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40355","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40355","date":"2026-11-12","epss":0.00645,"percentile":0.51443}],"urls":["https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html","https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f","https://web.mit.edu/kerberos/advisories/","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40355","description":"In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40356","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-40356","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40356","cwe":"CWE-191","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40356","date":"2026-11-12","epss":0.00604,"percentile":0.49402}],"risk":0.453,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-40356"},"relatedVulnerabilities":[{"id":"CVE-2026-40356","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40356","cwe":"CWE-191","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40356","date":"2026-11-12","epss":0.00604,"percentile":0.49402}],"urls":["https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html","https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f","https://web.mit.edu/kerberos/advisories/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40356","description":"In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message."}]},{"artifact":{"id":"512889d3101b0564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Http.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v76p-62qx-wwq2","versionConstraint":">=3.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-v76p-62qx-wwq2","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"risk":0.44625000000000004,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2","https://nvd.nist.gov/vuln/detail/CVE-2026-106118","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v76p-62qx-wwq2","description":"ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write"},"relatedVulnerabilities":[{"id":"CVE-2026-106118","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"urls":["https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106118","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1."}]},{"artifact":{"id":"372947be4de2d30c","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v76p-62qx-wwq2","versionConstraint":">=3.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-v76p-62qx-wwq2","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"risk":0.44625000000000004,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2","https://nvd.nist.gov/vuln/detail/CVE-2026-106118","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v76p-62qx-wwq2","description":"ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write"},"relatedVulnerabilities":[{"id":"CVE-2026-106118","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"urls":["https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106118","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1."}]},{"artifact":{"id":"6eb1bf9149bbdb09","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v76p-62qx-wwq2","versionConstraint":">=3.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-v76p-62qx-wwq2","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"risk":0.44625000000000004,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2","https://nvd.nist.gov/vuln/detail/CVE-2026-106118","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v76p-62qx-wwq2","description":"ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write"},"relatedVulnerabilities":[{"id":"CVE-2026-106118","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"urls":["https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106118","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1."}]},{"artifact":{"id":"c778c5fd3467c226","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Core.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v76p-62qx-wwq2","versionConstraint":">=3.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-v76p-62qx-wwq2","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"risk":0.44625000000000004,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2","https://nvd.nist.gov/vuln/detail/CVE-2026-106118","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v76p-62qx-wwq2","description":"ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write"},"relatedVulnerabilities":[{"id":"CVE-2026-106118","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"urls":["https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106118","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1."}]},{"artifact":{"id":"6b17dbd0912af564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Host.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v76p-62qx-wwq2","versionConstraint":">=3.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-v76p-62qx-wwq2","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"risk":0.44625000000000004,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2","https://nvd.nist.gov/vuln/detail/CVE-2026-106118","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v76p-62qx-wwq2","description":"ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write"},"relatedVulnerabilities":[{"id":"CVE-2026-106118","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"urls":["https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106118","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1."}]},{"artifact":{"id":"d40f0b61cd63bfbc","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.SignalR.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v76p-62qx-wwq2","versionConstraint":">=3.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-v76p-62qx-wwq2","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"risk":0.44625000000000004,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2","https://nvd.nist.gov/vuln/detail/CVE-2026-106118","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v76p-62qx-wwq2","description":"ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write"},"relatedVulnerabilities":[{"id":"CVE-2026-106118","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106118","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106118","date":"2026-11-12","epss":0.00595,"percentile":0.48957}],"urls":["https://github.com/SixLabors/ImageSharp/commit/9ee7d1dd5b62d8c9f16cc755e76828386bc2191f","https://github.com/SixLabors/ImageSharp/pull/3176","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.1","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-v76p-62qx-wwq2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106118","description":"ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore direct frame-width fax scanlines into a tile-width buffer when TileWidth is smaller than ImageWidth. The mismatch causes attacker-controlled out-of-bounds writes, heap corruption, and process termination even with legal per-row run codes. This tiled-path vulnerability is distinct from oversized CCITT runs in strip decoding. This issue is fixed in version 4.1.1."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.42665,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.40019999999999994,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"93a0da5a6bb82d14","cpes":["cpe:2.3:a:libxslt:libxslt:1.1.43-r3:*:*:*:*:*:*:*"],"name":"libxslt","purl":"pkg:apk/alpine/libxslt@1.1.43-r3?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.1.43-r3","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/xsltproc"},{"path":"/usr/lib"},{"path":"/usr/lib/libexslt.so.0"},{"path":"/usr/lib/libexslt.so.0.8.24"},{"path":"/usr/lib/libxslt.so.1"},{"path":"/usr/lib/libxslt.so.1.1.43"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxslt"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87636","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87636","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87636","fix":{"state":"fixed","versions":["1.1.43-r4"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.1.43-r4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87636","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-87636","date":"2026-11-12","epss":0.00451,"percentile":0.39642}],"risk":0.36756500000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87636"},"relatedVulnerabilities":[{"id":"CVE-2026-87636","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87636","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-87636","date":"2026-11-12","epss":0.00451,"percentile":0.39642}],"urls":["https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","https://issues.chromium.org/issues/495541478"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87636","description":"Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.340415,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.32775,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.297155,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"c778c5fd3467c226","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Core.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"6b17dbd0912af564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Host.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"512889d3101b0564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Http.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"d40f0b61cd63bfbc","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.SignalR.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"372947be4de2d30c","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"6eb1bf9149bbdb09","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j3p4-wp97-rph4","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j3p4-wp97-rph4","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"risk":0.2925,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4","https://nvd.nist.gov/vuln/detail/CVE-2026-106113","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j3p4-wp97-rph4","description":"ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index"},"relatedVulnerabilities":[{"id":"CVE-2026-106113","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-106113","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-106113","date":"2026-11-12","epss":0.0039,"percentile":0.33647}],"urls":["https://github.com/SixLabors/ImageSharp/commit/c4c4bf292298c026df470db1a17ff826515fd95d","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j3p4-wp97-rph4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106113","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected by this report. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"372947be4de2d30c","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"6eb1bf9149bbdb09","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"c778c5fd3467c226","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Core.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"6b17dbd0912af564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Host.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"512889d3101b0564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Http.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"d40f0b61cd63bfbc","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.SignalR.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-j9gm-c75j-xc9q","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-j9gm-c75j-xc9q","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q","https://nvd.nist.gov/vuln/detail/CVE-2026-106110","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-j9gm-c75j-xc9q","description":"ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106110","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106110","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106110","date":"2026-11-12","epss":0.00385,"percentile":0.33094}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-j9gm-c75j-xc9q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106110","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"372947be4de2d30c","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"c778c5fd3467c226","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Core.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"6eb1bf9149bbdb09","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"6b17dbd0912af564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Host.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"512889d3101b0564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Http.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"d40f0b61cd63bfbc","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.SignalR.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jjfr-hcj7-qf5w","versionConstraint":">=2.1.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-jjfr-hcj7-qf5w","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"risk":0.28875,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w","https://nvd.nist.gov/vuln/detail/CVE-2026-106115","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"High","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jjfr-hcj7-qf5w","description":"ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer"},"relatedVulnerabilities":[{"id":"CVE-2026-106115","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106115","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106115","date":"2026-11-12","epss":0.00385,"percentile":0.33092}],"urls":["https://github.com/SixLabors/ImageSharp/commit/a9498c6db3642ef92c712ebc81e706914ac16a95","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-jjfr-hcj7-qf5w"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106115","description":"ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"193eb40fb65beba6","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r1:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.3.2-r1","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-4738","fix":{"state":"fixed","versions":["1.4-r0"],"available":[{"date":"2026-11-07","kind":"first-observed","version":"1.4-r0"}]},"cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-12","epss":0.00269,"percentile":0.19241}],"risk":0.24748,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-4738"},"relatedVulnerabilities":[{"id":"CVE-2026-4738","cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-12","epss":0.00269,"percentile":0.19241}],"urls":["https://github.com/OSGeo/gdal/pull/12244"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4738","description":"Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0."}]},{"artifact":{"id":"93a0da5a6bb82d14","cpes":["cpe:2.3:a:libxslt:libxslt:1.1.43-r3:*:*:*:*:*:*:*"],"name":"libxslt","purl":"pkg:apk/alpine/libxslt@1.1.43-r3?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.1.43-r3","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/xsltproc"},{"path":"/usr/lib"},{"path":"/usr/lib/libexslt.so.0"},{"path":"/usr/lib/libexslt.so.0.8.24"},{"path":"/usr/lib/libxslt.so.1"},{"path":"/usr/lib/libxslt.so.1.1.43"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxslt"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9947","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9947","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-9947","fix":{"state":"fixed","versions":["1.1.43-r4"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.1.43-r4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9947","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-9947","date":"2026-11-12","epss":0.00303,"percentile":0.2336}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-9947"},"relatedVulnerabilities":[{"id":"CVE-2026-9947","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9947","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-9947","date":"2026-11-12","epss":0.00303,"percentile":0.2336}],"urls":["https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html","https://issues.chromium.org/issues/503627446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9947","description":"Use after free in XML in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119379","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119379","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-12","epss":0.00278,"percentile":0.20526}],"risk":0.217535,"urls":["https://abraxaslabs.tech/research/sqlite-session-ncol","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/3f57024aecea0f3b","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119379","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119374","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119374","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-12","epss":0.0023,"percentile":0.13979}],"risk":0.179975,"urls":["https://abraxaslabs.tech/research/sqlite-fts5-securedel","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525","https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/9cd4f9e920","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119374","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"512889d3101b0564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Http.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"6eb1bf9149bbdb09","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"6b17dbd0912af564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Host.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"d40f0b61cd63bfbc","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.SignalR.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"372947be4de2d30c","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"c778c5fd3467c226","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Core.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwg2-r3hj-4w44","versionConstraint":">=1.0.0-beta0001,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-gwg2-r3hj-4w44","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44","https://nvd.nist.gov/vuln/detail/CVE-2026-106114","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwg2-r3hj-4w44","description":"ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions"},"relatedVulnerabilities":[{"id":"CVE-2026-106114","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106114","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106114","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/8de892a7623aa8a09ba2333b624c8d2eb98325df","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-gwg2-r3hj-4w44"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106114","description":"ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier public IccProfile.Entries parsing paths can allocate a large jagged representation, from a short truncated profile. In version 4, automatic image conversion reaches the parser when DecoderOptions.ColorProfileHandling is Convert; the default Preserve mode avoids that conversion path. The demonstrated impact is memory pressure and input-validation failure, not unhandled process termination. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"6b17dbd0912af564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Host.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Host.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"d40f0b61cd63bfbc","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.SignalR.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.SignalR.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"512889d3101b0564","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Http.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Http.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"c778c5fd3467c226","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Core.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Core.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"6eb1bf9149bbdb09","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.Api.V3.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"372947be4de2d30c","cpes":["cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:sixlabors_imagesharp:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp_.net:3.1.12:*:*:*:*:*:*:*","cpe:2.3:a:six_labors:sixlabors_imagesharp:3.1.12:*:*:*:*:*:*:*"],"name":"SixLabors.ImageSharp","purl":"pkg:nuget/SixLabors.ImageSharp@3.1.12","type":"dotnet","version":"3.1.12","language":"dotnet","licenses":[],"locations":[{"path":"/app/sonarr/bin/Sonarr.deps.json","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/Sonarr.deps.json","annotations":{"evidence":"primary"}},{"path":"/app/sonarr/bin/SixLabors.ImageSharp.dll","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/app/sonarr/bin/SixLabors.ImageSharp.dll","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wmxv-xphr-5c9g","versionConstraint":">=2.0.0,<3.2.0 (semantic)"},"matcher":"dotnet-matcher","searchedBy":{"package":{"name":"SixLabors.ImageSharp","version":"3.1.12"},"language":"dotnet","namespace":"github:language:dotnet"}}],"vulnerability":{"id":"GHSA-wmxv-xphr-5c9g","fix":{"state":"fixed","versions":["3.2.0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"3.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"risk":0.16892000000000001,"urls":["https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g","https://nvd.nist.gov/vuln/detail/CVE-2026-106116","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/pull/3208","https://github.com/SixLabors/ImageSharp/commit/baa37cd19077b2a2a0c5667535111cf31d48c019","https://github.com/SixLabors/ImageSharp/releases/tag/v3.2.0"],"severity":"Medium","namespace":"github:language:dotnet","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wmxv-xphr-5c9g","description":"ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop"},"relatedVulnerabilities":[{"id":"CVE-2026-106116","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-106116","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-106116","date":"2026-11-12","epss":0.00328,"percentile":0.2633}],"urls":["https://github.com/SixLabors/ImageSharp/commit/92b12d72550ebb6be5b1e22e559c361fd863a6ec","https://github.com/SixLabors/ImageSharp/pull/3187","https://github.com/SixLabors/ImageSharp/releases/tag/v4.1.2","https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106116","description":"ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2."}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119378","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119378","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-12","epss":0.00251,"percentile":0.16587}],"risk":0.13993250000000002,"urls":["https://abraxaslabs.tech/research/sqlite-rtree-rowid0","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905","https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/6a9e1415659f9e75","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119378","description":"SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119373","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119373","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-12","epss":0.00162,"percentile":0.05485}],"risk":0.126765,"urls":["https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107","https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80","https://sqlite.org/bugs/info/2026-08-04T08:49:27Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/a7f8c92f62","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119373","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119375","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119375","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119375","date":"2026-11-12","epss":0.00195,"percentile":0.09266}],"risk":0.1087125,"urls":["https://abraxaslabs.tech/research/sqlite-wal-pagesize","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672","https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e","https://sqlite.org/bugs/info/2026-08-17T15:54:41Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f9b4ee369557c36c","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119375","description":"SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119371","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119371","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-12","epss":0.00191,"percentile":0.08871}],"risk":0.1064825,"urls":["https://abraxaslabs.tech/research/sqlite-cte-nest","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754","https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb","https://sqlite.org/bugs/info/2026-10-04T04:58:58Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f54730871303e655","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119371","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119376","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119376","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119376","date":"2026-11-12","epss":0.00183,"percentile":0.07943}],"risk":0.1020225,"urls":["https://abraxaslabs.tech/research/sqlite-collate-depth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175","https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2","https://sqlite.org/bugs/info/2026-10-04T04:50:56Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/252c0b7bf5a727d2","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119376","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119591","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119591","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119591","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119591","date":"2026-11-12","epss":0.00171,"percentile":0.06577}],"risk":0.0953325,"urls":["https://abraxaslabs.tech/research/sqlite-values-union","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199","https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2","https://sqlite.org/bugs/info/2026-10-04T05:34:47Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/ab621a3e11ee4acc","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119591","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"93a0da5a6bb82d14","cpes":["cpe:2.3:a:libxslt:libxslt:1.1.43-r3:*:*:*:*:*:*:*"],"name":"libxslt","purl":"pkg:apk/alpine/libxslt@1.1.43-r3?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.1.43-r3","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/xsltproc"},{"path":"/usr/lib"},{"path":"/usr/lib/libexslt.so.0"},{"path":"/usr/lib/libexslt.so.0.8.24"},{"path":"/usr/lib/libxslt.so.1"},{"path":"/usr/lib/libxslt.so.1.1.43"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxslt"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-10911","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10911","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2025-10911","fix":{"state":"fixed","versions":["1.1.43-r4"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.1.43-r4"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10911","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-10911","date":"2026-11-12","epss":0.00173,"percentile":0.06733}],"risk":0.090825,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2025-10911"},"relatedVulnerabilities":[{"id":"CVE-2025-10911","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10911","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-10911","date":"2026-11-12","epss":0.00173,"percentile":0.06733}],"urls":["https://access.redhat.com/errata/RHSA-2026:11015","https://access.redhat.com/errata/RHSA-2026:26355","https://access.redhat.com/errata/RHSA-2026:28243","https://access.redhat.com/errata/RHSA-2026:28584","https://access.redhat.com/errata/RHSA-2026:29807","https://access.redhat.com/errata/RHSA-2026:29809","https://access.redhat.com/errata/RHSA-2026:29811","https://access.redhat.com/errata/RHSA-2026:29814","https://access.redhat.com/errata/RHSA-2026:29975","https://access.redhat.com/errata/RHSA-2026:29976","https://access.redhat.com/errata/RHSA-2026:30847","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2025-10911","https://bugzilla.redhat.com/show_bug.cgi?id=2397838","https://gitlab.gnome.org/GNOME/libxslt/-/issues/144","https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10911","description":"A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash."}]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119372","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119372","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119372","date":"2026-11-12","epss":0.00147,"percentile":0.04011}],"risk":0.0819525,"urls":["https://abraxaslabs.tech/research/sqlite-fts3-snippet","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561","https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731","https://sqlite.org/bugs/info/2026-08-17T09:18:24Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/e4635c4153","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119372","description":"SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119377","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119377","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119377","date":"2026-11-12","epss":0.00129,"percentile":0.02546}],"risk":0.03612,"urls":["https://abraxaslabs.tech/research/sqlite-fj-using-auth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775","https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8","https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237","https://sqlite.org/bugs/info/2026-07-05T08:15:45Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/2cb22877683680c1","https://sqlite.org/src/info/bbd69ce274620008","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119377","description":"SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions."},"relatedVulnerabilities":[]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107364","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107364","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107364"},"relatedVulnerabilities":[{"id":"CVE-2026-107364","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107884","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107884","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107884"},"relatedVulnerabilities":[{"id":"CVE-2026-107884","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111423","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111423","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111423"},"relatedVulnerabilities":[{"id":"CVE-2026-111423","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118380","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-118380","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-118380"},"relatedVulnerabilities":[{"id":"CVE-2026-118380","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71199","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-71199","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-71199"},"relatedVulnerabilities":[{"id":"CVE-2026-71199","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"894cd149061e9d11","cpes":["cpe:2.3:a:krb5-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb-libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb_libs:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb5:krb_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb5_libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb-libs:1.22.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:krb:krb_libs:1.22.2-r1:*:*:*:*:*:*:*"],"name":"krb5-libs","purl":"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=alpine-3.24.3&upstream=krb5","type":"apk","version":"1.22.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libgssapi_krb5.so.2"},{"path":"/usr/lib/libgssapi_krb5.so.2.2"},{"path":"/usr/lib/libgssrpc.so.4"},{"path":"/usr/lib/libgssrpc.so.4.2"},{"path":"/usr/lib/libk5crypto.so.3"},{"path":"/usr/lib/libk5crypto.so.3.1"},{"path":"/usr/lib/libkadm5clnt_mit.so.12"},{"path":"/usr/lib/libkadm5clnt_mit.so.12.0"},{"path":"/usr/lib/libkadm5srv_mit.so.12"},{"path":"/usr/lib/libkadm5srv_mit.so.12.0"},{"path":"/usr/lib/libkdb5.so.10"},{"path":"/usr/lib/libkdb5.so.10.0"},{"path":"/usr/lib/libkrad.so.0"},{"path":"/usr/lib/libkrad.so.0.0"},{"path":"/usr/lib/libkrb5.so.3"},{"path":"/usr/lib/libkrb5.so.3.3"},{"path":"/usr/lib/libkrb5support.so.0"},{"path":"/usr/lib/libkrb5support.so.0.1"},{"path":"/usr/lib/krb5"},{"path":"/usr/lib/krb5/plugins"},{"path":"/usr/lib/krb5/plugins/authdata"},{"path":"/usr/lib/krb5/plugins/kdb"},{"path":"/usr/lib/krb5/plugins/kdb/db2.so"},{"path":"/usr/lib/krb5/plugins/libkrb5"},{"path":"/usr/lib/krb5/plugins/preauth"},{"path":"/usr/lib/krb5/plugins/preauth/otp.so"},{"path":"/usr/lib/krb5/plugins/preauth/spake.so"},{"path":"/usr/lib/krb5/plugins/preauth/test.so"},{"path":"/usr/lib/krb5/plugins/tls"},{"path":"/usr/lib/krb5/plugins/tls/k5tls.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:684021de4bac41df1bb7850c72cb1ed1907fcac2a3c6c989a8e5202250347362","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"krb5"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.22.3-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-71200","versionConstraint":"< 1.22.3-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"krb5","version":"1.22.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-71200","fix":{"state":"fixed","versions":["1.22.3-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.22.3-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-71200"},"relatedVulnerabilities":[{"id":"CVE-2026-71200","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T08:33:58.424Z","grype_db_version":"2026-11-13T15:40:34.000Z"}